@routr/connect 2.15.3 → 2.16.0

package/dist/access.js

@@ -31,6 +31,7 @@ exports.checkAccessFromPSTN = exports.checkAgentOrPeerAccess = exports.checkAcce
 const logger_1 = require("@fonoster/logger");
 const common_1 = require("@routr/common");
 const types_1 = require("./types");
+const utils_1 = require("./utils");
 const logger = (0, logger_1.getLogger)({ service: "connect", filePath: __filename });
 const checkAccess = (accessRequest) => __awaiter(void 0, void 0, void 0, function* () {
     const { apiClient, request, caller, callee, routingDirection } = accessRequest;
@@ -80,11 +81,16 @@ const checkAccessFromPSTN = (apiClient, request, callee) => __awaiter(void 0, vo
         return common_1.CommonResponse.createForbiddenResponse();
     }
     // Verify that the IP is allowlist which means getting the access control list for the trunk
+    // The source is the top Via's "received" value (set by the SIP stack when the
+    // packet came from another address), not request.sender.host, which is copied
+    // from the Via host and can be forged.
     if (trunk.accessControlList) {
         try {
-            const allow = trunk.accessControlList.allow.filter((net) => {
-                return common_1.IpUtils.hasIp(net, request.sender.host);
-            })[0];
+            const source = (0, utils_1.getSourceAddress)(request);
+            const allow = source &&
+                trunk.accessControlList.allow.filter((net) => {
+                    return common_1.IpUtils.hasIp(net, source);
+                })[0];
             if (!allow) {
                 return common_1.CommonResponse.createUnauthorizedResponseWithoutChallenge();
             }

package/dist/envs.d.ts

@@ -4,3 +4,7 @@ export declare const API_ADDR: string;
 export declare const CONNECT_VERIFIER_ADDR: string;
 export declare const CONNECT_VERIFIER_PUBLIC_KEY_PATH: string;
 export declare const CONNECT_VERIFIER_OPTIONS: any;
+export declare const DEFAULT_UNTRUSTED_HEADERS_TO_STRIP: string[];
+export declare const UNTRUSTED_HEADERS_TO_STRIP: string[];
+export declare const TRUSTED_EDGEPORTS: string[];
+export declare const TRUSTED_EDGEPORT_ADDRESSES: string[];

package/dist/envs.js

@@ -1,7 +1,7 @@
 "use strict";
 var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONNECT_VERIFIER_OPTIONS = exports.CONNECT_VERIFIER_PUBLIC_KEY_PATH = exports.CONNECT_VERIFIER_ADDR = exports.API_ADDR = exports.LOCATION_ADDR = exports.BIND_ADDR = void 0;
+exports.TRUSTED_EDGEPORT_ADDRESSES = exports.TRUSTED_EDGEPORTS = exports.UNTRUSTED_HEADERS_TO_STRIP = exports.DEFAULT_UNTRUSTED_HEADERS_TO_STRIP = exports.CONNECT_VERIFIER_OPTIONS = exports.CONNECT_VERIFIER_PUBLIC_KEY_PATH = exports.CONNECT_VERIFIER_ADDR = exports.API_ADDR = exports.LOCATION_ADDR = exports.BIND_ADDR = void 0;
 /*
  * Copyright (C) 2026 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/routr
@@ -30,3 +30,39 @@ exports.CONNECT_VERIFIER_PUBLIC_KEY_PATH = process.env.CONNECT_VERIFIER_PUBLIC_K
 exports.CONNECT_VERIFIER_OPTIONS = process.env.CONNECT_VERIFIER_OPTIONS
     ? JSON.parse(process.env.CONNECT_VERIFIER_OPTIONS)
     : { expiresIn: "1h", algorithm: ["RS256"] };
+// Platform headers a caller must never be able to set. They are removed from
+// requests that come from untrusted sources (e.g., the PSTN or a client using a
+// Connect Token) before Routr adds its own. Override with a comma-separated list;
+// set it to an empty string to disable stripping.
+exports.DEFAULT_UNTRUSTED_HEADERS_TO_STRIP = [
+    "X-App-Ref",
+    "X-Call-Ref",
+    "X-Call-Direction",
+    "X-DOD-Number",
+    "X-DOD-Privacy",
+    "X-Access-Key-Id",
+    "X-Is-Api-Originated-Type",
+    "X-Edgeport-Ref",
+    "X-Gateway-Auth",
+    "X-Request-Uri",
+    "X-Session-Count"
+];
+exports.UNTRUSTED_HEADERS_TO_STRIP = process.env.UNTRUSTED_HEADERS_TO_STRIP !== undefined
+    ? process.env.UNTRUSTED_HEADERS_TO_STRIP.split(",")
+        .map((h) => h.trim())
+        .filter((h) => h.length > 0)
+    : exports.DEFAULT_UNTRUSTED_HEADERS_TO_STRIP;
+const parseList = (value) => (value !== null && value !== void 0 ? value : "")
+    .split(",")
+    .map((v) => v.trim())
+    .filter((v) => v.length > 0);
+// Peer EdgePorts allowed to forward requests with X-Edgeport-Ref. Such a request
+// skips routing and access checks (its route is rebuilt from the message), so it
+// is only honored when the packet comes from an address in
+// TRUSTED_EDGEPORT_ADDRESSES (IPs or CIDRs, matched against the top Via's
+// "received" value, or its host when "received" is absent). TRUSTED_EDGEPORTS
+// optionally narrows which X-Edgeport-Ref values are accepted. The defaults trust
+// no peer EdgePort, which is right for single-EdgePort deployments: the header is
+// removed and the request is routed normally.
+exports.TRUSTED_EDGEPORTS = parseList(process.env.TRUSTED_EDGEPORTS);
+exports.TRUSTED_EDGEPORT_ADDRESSES = parseList(process.env.TRUSTED_EDGEPORT_ADDRESSES);

package/dist/handlers/request.d.ts

@@ -1,4 +1,5 @@
 import { MessageRequest, Response } from "@routr/processor";
 import { ILocationService } from "@routr/location";
 import { CommonConnect as CC } from "@routr/common";
-export declare const handleRequest: (location: ILocationService, apiClient?: CC.APIClient) => (request: MessageRequest, res: Response) => Promise<void>;
+import { EdgePortTrust } from "../utils";
+export declare const handleRequest: (location: ILocationService, apiClient?: CC.APIClient, edgePortTrust?: EdgePortTrust) => (request: MessageRequest, res: Response) => Promise<void>;

package/dist/handlers/request.js

@@ -70,12 +70,33 @@ const location_1 = require("@routr/location");
 const common_1 = require("@routr/common");
 const logger_1 = require("@fonoster/logger");
 const types_1 = require("./../types");
+const utils_1 = require("../utils");
+const envs_1 = require("../envs");
 const logger = (0, logger_1.getLogger)({ service: "connect", filePath: __filename });
 const enforceE164 = processor_1.Alterations.enforceE164(common_1.Environment.ENFORCE_E164, common_1.Environment.ENFORCE_E164_WITH_MOBILE_PREFIX);
-const handleRequest = (location, apiClient) => (request, res) => __awaiter(void 0, void 0, void 0, function* () {
+const defaultEdgePortTrust = {
+    refs: envs_1.TRUSTED_EDGEPORTS,
+    addresses: envs_1.TRUSTED_EDGEPORT_ADDRESSES
+};
+const handleRequest = (location, apiClient, edgePortTrust = defaultEdgePortTrust) => (request, res) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
     try {
-        const req = common_1.Environment.ENFORCE_E164 ? enforceE164(request) : request;
+        let req = common_1.Environment.ENFORCE_E164 ? enforceE164(request) : request;
         let route;
+        // X-Edgeport-Ref marks a request forwarded by a peer EdgePort, whose route
+        // is rebuilt from the message without routing or access checks. Honor it
+        // only from a trusted peer EdgePort. Anyone else could use it to relay calls
+        // through Routr (toll fraud), so remove it and route the request normally.
+        const fromTrustedEdgePort = (0, utils_1.isFromTrustedEdgePort)(req, edgePortTrust);
+        if (!fromTrustedEdgePort &&
+            processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.EDGEPORT_REF)) {
+            logger.warn("ignoring X-Edgeport-Ref from an untrusted source", {
+                ref: req.ref,
+                edgePortRef: req.edgePortRef,
+                via: (_a = req.message.via) === null || _a === void 0 ? void 0 : _a[0]
+            });
+            req = processor_1.Alterations.removeXEdgePortRef(req);
+        }
         // A CANCEL must follow the exact path its INVITE took (RFC 3261 §9.1) — it is
         // never a new call to route. edgeport already forwards it correctly, straight
         // from the INVITE's own client transaction (GRPCSipListener#sendCancel), which
@@ -87,8 +108,7 @@ const handleRequest = (location, apiClient) => (request, res) => __awaiter(void
         // reaches edgeport's already-correct CANCEL handling. The result: the CANCEL is
         // silently dropped, the call keeps ringing, and if the callee answers a moment
         // later they connect into a line the caller has already abandoned.
-        if (processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.EDGEPORT_REF) ||
-            req.method === common_1.CommonTypes.Method.CANCEL) {
+        if (fromTrustedEdgePort || req.method === common_1.CommonTypes.Method.CANCEL) {
             route = location_1.Helper.createRouteFromLastMessage(req);
         }
         else {
@@ -105,6 +125,9 @@ const handleRequest = (location, apiClient) => (request, res) => __awaiter(void
             else if (!routerResult.route) {
                 return res.sendTemporarilyUnavailable();
             }
+            // Remove platform headers a caller from an untrusted source (e.g., the
+            // PSTN) could have spoofed. Routr re-adds its own values afterwards.
+            req = processor_1.Alterations.removeHeaders((0, utils_1.getUntrustedHeadersToStrip)(direction, !!(0, utils_1.hasXConnectObjectHeader)(req), envs_1.UNTRUSTED_HEADERS_TO_STRIP))(req);
             const p = {
                 name: common_1.CommonTypes.ExtraHeader.CALL_DIRECTION,
                 value: direction,

package/dist/router.js

@@ -280,6 +280,7 @@ function agentToPeer(location, callee, req) {
 // eslint-disable-next-line require-jsdoc
 function peerToPSTN(apiClient, req) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const numberTel = processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.DOD_NUMBER);
         const privacy = processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.DOD_PRIVACY);
         if (!numberTel) {
@@ -289,6 +290,16 @@ function peerToPSTN(apiClient, req) {
         if (!number) {
             return common_1.CommonResponse.createNotFoundResponse(`No Number found for tel:${numberTel}`);
         }
+        // A Number bound to an access key (e.g., a Fonoster workspace) may only be
+        // used by a request that carries the same X-Access-Key-Id
+        const numberAccessKeyId = (_a = number.extended) === null || _a === void 0 ? void 0 : _a.accessKeyId;
+        if (numberAccessKeyId &&
+            numberAccessKeyId !== processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.ACCESS_KEY_ID)) {
+            logger.verbose("rejected peer-to-pstn request: access key mismatch", {
+                numberRef: number.ref
+            });
+            return common_1.CommonResponse.createForbiddenResponse();
+        }
         if (!number.trunk) {
             // TODO: Create custom error
             throw new Error(`no trunk associated with Number ref: ${number.ref}`);

package/dist/service.d.ts

@@ -1,2 +1,17 @@
 import { ConnectProcessorConfig } from "./types";
+import { MessageRequest } from "@routr/common";
+import { Response } from "@routr/processor";
+import { CommonConnect as CC } from "@routr/common";
+import { ILocationService } from "@routr/location";
+/**
+ * Builds the connect processor's message handler. Exported so the dispatch can be
+ * unit tested without a gRPC server.
+ *
+ * @param {object} deps - the API client and location service the handlers use
+ * @return {Function} the handler to pass to Processor#listen
+ */
+export declare const createDispatcher: (deps: {
+    apiClient: CC.APIClient;
+    location: ILocationService;
+}) => (req: MessageRequest, res: Response) => Promise<void>;
 export default function connectProcessor(config: ConnectProcessorConfig): void;

package/dist/service.js

@@ -42,6 +42,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDispatcher = void 0;
 exports.default = connectProcessor;
 const common_1 = require("@routr/common");
 const location_1 = require("@routr/location");
@@ -52,50 +53,82 @@ const logger_1 = require("@fonoster/logger");
 const request_1 = require("./handlers/request");
 const registry_1 = require("./handlers/registry");
 const register_1 = require("./handlers/register");
+const utils_1 = require("./utils");
 const logger = (0, logger_1.getLogger)({ service: "connect", filePath: __filename });
+/**
+ * Forwards a request that belongs to an existing dialog along its route set: strip
+ * our own Route, add our Via, and let the EdgePort send it to the next hop or the
+ * Request-URI. No routing and no access checks, the dialog was authorized when it
+ * was set up. BYE and ACK always took this path; since RFC 3261 section 12.2 makes
+ * any request with a To tag an in-dialog request, re-INVITE, UPDATE, INFO, REFER and
+ * the NOTIFY that follows a REFER take it too.
+ *
+ * @param {MessageRequest} req - the in-dialog request
+ * @param {Response} res - the response object used to send it on
+ * @return {void}
+ */
+const forwardInDialog = (req, res) => res.send((0, function_1.pipe)(req, processor_1.Alterations.decreaseMaxForwards, processor_1.Alterations.addSelfViaUsingExternalAddrs, processor_1.Alterations.removeSelfRoutes));
+/**
+ * Builds the connect processor's message handler. Exported so the dispatch can be
+ * unit tested without a gRPC server.
+ *
+ * @param {object} deps - the API client and location service the handlers use
+ * @return {Function} the handler to pass to Processor#listen
+ */
+const createDispatcher = (deps) => (req, res) => __awaiter(void 0, void 0, void 0, function* () {
+    const { apiClient, location } = deps;
+    logger.verbose("connect processor received new request", {
+        ref: req.ref,
+        method: req.method,
+        type: req.message.messageType === common_2.CommonTypes.MessageType.RESPONSE
+            ? "(response)"
+            : "(request)",
+        edgePort: req.edgePortRef
+    });
+    logger.silly(JSON.stringify(req, null, " "));
+    // If it is a response simply forwards to uac
+    if (processor_1.Helper.isTypeResponse(req)) {
+        // Remove the proxy and overwrite the contact with the sender info
+        return res.send(
+        // NOTE: We should consider making the overwriteContactWithSenderInfo an Agent/Peer level alteration
+        // pipe(req, A.overwriteContactWithSenderInfo, A.removeTopVia)
+        (0, function_1.pipe)(req, processor_1.Alterations.removeTopVia));
+    }
+    // REGISTER never carries a To tag and CANCEL keeps its own path (it follows
+    // the INVITE it cancels); everything else with a To tag is in a dialog.
+    if (req.method !== common_1.Method.REGISTER &&
+        req.method !== common_1.Method.CANCEL &&
+        (0, utils_1.isInDialog)(req)) {
+        return forwardInDialog(req, res);
+    }
+    switch (req.method) {
+        case common_1.Method.PUBLISH:
+        case common_1.Method.NOTIFY:
+        case common_1.Method.SUBSCRIBE:
+        case common_1.Method.MESSAGE:
+            res.sendMethodNotAllowed();
+            break;
+        case common_1.Method.REGISTER:
+            if (processor_1.Extensions.getHeaderValue(req, common_2.CommonTypes.ExtraHeader.GATEWAY_AUTH)) {
+                (0, registry_1.handleRegistry)(req, res);
+            }
+            else {
+                return (0, register_1.handleRegister)(apiClient, location)(req, res);
+            }
+            break;
+        case common_1.Method.BYE:
+        case common_1.Method.ACK:
+            forwardInDialog(req, res);
+            break;
+        default:
+            return (0, request_1.handleRequest)(location, apiClient)(req, res);
+    }
+});
+exports.createDispatcher = createDispatcher;
 // eslint-disable-next-line require-jsdoc
 function connectProcessor(config) {
     const { bindAddr, locationAddr } = config;
     const location = new location_1.LocationClient({ addr: locationAddr });
-    new processor_1.default({ bindAddr, name: "connect" }).listen((req, res) => __awaiter(this, void 0, void 0, function* () {
-        logger.verbose("connect processor received new request", {
-            ref: req.ref,
-            method: req.method,
-            type: req.message.messageType === common_2.CommonTypes.MessageType.RESPONSE
-                ? "(response)"
-                : "(request)",
-            edgePort: req.edgePortRef
-        });
-        logger.silly(JSON.stringify(req, null, " "));
-        // If it is a response simply forwards to uac
-        if (processor_1.Helper.isTypeResponse(req)) {
-            // Remove the proxy and overwrite the contact with the sender info
-            return res.send(
-            // NOTE: We should consider making the overwriteContactWithSenderInfo an Agent/Peer level alteration
-            // pipe(req, A.overwriteContactWithSenderInfo, A.removeTopVia)
-            (0, function_1.pipe)(req, processor_1.Alterations.removeTopVia));
-        }
-        switch (req.method) {
-            case common_1.Method.PUBLISH:
-            case common_1.Method.NOTIFY:
-            case common_1.Method.SUBSCRIBE:
-            case common_1.Method.MESSAGE:
-                res.sendMethodNotAllowed();
-                break;
-            case common_1.Method.REGISTER:
-                if (processor_1.Extensions.getHeaderValue(req, common_2.CommonTypes.ExtraHeader.GATEWAY_AUTH)) {
-                    (0, registry_1.handleRegistry)(req, res);
-                }
-                else {
-                    (0, register_1.handleRegister)(common_2.CommonConnect.apiClient({ apiAddr: config.apiAddr }), location)(req, res);
-                }
-                break;
-            case common_1.Method.BYE:
-            case common_1.Method.ACK:
-                res.send((0, function_1.pipe)(req, processor_1.Alterations.decreaseMaxForwards, processor_1.Alterations.addSelfViaUsingExternalAddrs, processor_1.Alterations.removeSelfRoutes));
-                break;
-            default:
-                (0, request_1.handleRequest)(location, common_2.CommonConnect.apiClient({ apiAddr: config.apiAddr }))(req, res);
-        }
-    }));
+    const apiClient = common_2.CommonConnect.apiClient({ apiAddr: config.apiAddr });
+    new processor_1.default({ bindAddr, name: "connect" }).listen((0, exports.createDispatcher)({ apiClient, location }));
 }

package/dist/utils.d.ts

@@ -18,7 +18,59 @@ export declare const getSipUri: (uri: {
     user?: string;
     host: string;
 }) => string;
+/**
+ * Whether a request belongs to an existing dialog: RFC 3261 section 12.2, a request
+ * inside a dialog carries the To tag the dialog was established with. Such a request is
+ * forwarded along the dialog's route set and is never routed as a new call, which
+ * would send a hold or transfer re-INVITE to the PSTN trunk and answer the provider's
+ * re-INVITE with 500 (Routr v1 fixed the same bug in issue #58). The EdgePort refuses
+ * an in-dialog INVITE or REFER for a dialog it did not proxy, so forwarding here does
+ * not bypass access checks for a forged To tag.
+ *
+ * @param {MessageRequest} req - The request
+ * @return {boolean} true when the To header carries a tag
+ */
+export declare const isInDialog: (req: MessageRequest) => boolean;
 export declare const hasXConnectObjectHeader: (req: MessageRequest) => string;
 export declare const getVerifierImpl: () => {
     verify: (token: string) => Promise<import("@routr/common/dist/errors").ServiceUnavailableError | V.VerifyResponse>;
 };
+/**
+ * Returns the headers that must be removed from a request before it is forwarded.
+ *
+ * Requests from authenticated Agents and Peers are trusted and keep their headers.
+ * Requests from the PSTN, and requests authorized only by a Connect Token, are not:
+ * the platform headers in `headers` are removed so a caller can't spoof them.
+ * A client using a verified Connect Token keeps its X-App-Ref.
+ *
+ * @param {RoutingDirection} direction - The routing direction of the request
+ * @param {boolean} withConnectToken - Whether the request carried a verified X-Connect-Token
+ * @param {string[]} headers - The headers to strip from untrusted requests
+ * @return {string[]} The headers to remove
+ */
+export declare const getUntrustedHeadersToStrip: (direction: RoutingDirection, withConnectToken: boolean, headers: string[]) => string[];
+export interface EdgePortTrust {
+    refs: string[];
+    addresses: string[];
+}
+/**
+ * Returns the address the request came from: the top Via's "received" value,
+ * which the SIP stack sets when the packet's source differs from the Via host
+ * (RFC 3261 §18.2.1), or the Via host otherwise.
+ *
+ * @param {MessageRequest} request - The request
+ * @return {string | undefined} The source address
+ */
+export declare const getSourceAddress: (request: MessageRequest) => string | undefined;
+/**
+ * Tells whether a request carrying X-Edgeport-Ref was forwarded by a trusted peer
+ * EdgePort. Only such a request may take the last-message fast path, which skips
+ * routing and access checks. The header value alone proves nothing (anyone can
+ * set it), so the request's source address must be in `trust.addresses`; when
+ * `trust.refs` is not empty, the header value must also be one of them.
+ *
+ * @param {MessageRequest} request - The request
+ * @param {EdgePortTrust} trust - The trusted peer EdgePorts
+ * @return {boolean} true if the request comes from a trusted peer EdgePort
+ */
+export declare const isFromTrustedEdgePort: (request: MessageRequest, trust: EdgePortTrust) => boolean;

package/dist/utils.js

@@ -45,7 +45,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getVerifierImpl = exports.hasXConnectObjectHeader = exports.getSipUri = exports.getTrunkURI = exports.createTrunkAuthentication = exports.createRemotePartyId = exports.createPAssertedIdentity = exports.getRoutingDirection = exports.findResource = exports.findNumberByTelUrl = exports.findDomain = exports.isKind = void 0;
+exports.isFromTrustedEdgePort = exports.getSourceAddress = exports.getUntrustedHeadersToStrip = exports.getVerifierImpl = exports.hasXConnectObjectHeader = exports.isInDialog = exports.getSipUri = exports.getTrunkURI = exports.createTrunkAuthentication = exports.createRemotePartyId = exports.createPAssertedIdentity = exports.getRoutingDirection = exports.findResource = exports.findNumberByTelUrl = exports.findDomain = exports.isKind = void 0;
 /*
  * Copyright (C) 2026 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/routr
@@ -206,6 +206,20 @@ const getTrunkURI = (trunk) => {
 exports.getTrunkURI = getTrunkURI;
 const getSipUri = (uri) => uri.user ? `sip:${uri.user}@${uri.host}` : `sip:${uri.host}`;
 exports.getSipUri = getSipUri;
+/**
+ * Whether a request belongs to an existing dialog: RFC 3261 section 12.2, a request
+ * inside a dialog carries the To tag the dialog was established with. Such a request is
+ * forwarded along the dialog's route set and is never routed as a new call, which
+ * would send a hold or transfer re-INVITE to the PSTN trunk and answer the provider's
+ * re-INVITE with 500 (Routr v1 fixed the same bug in issue #58). The EdgePort refuses
+ * an in-dialog INVITE or REFER for a dialog it did not proxy, so forwarding here does
+ * not bypass access checks for a forged To tag.
+ *
+ * @param {MessageRequest} req - The request
+ * @return {boolean} true when the To header carries a tag
+ */
+const isInDialog = (req) => { var _a; return !!((_a = req.message.to) === null || _a === void 0 ? void 0 : _a.tag); };
+exports.isInDialog = isInDialog;
 const hasXConnectObjectHeader = (req) => processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.CONNECT_TOKEN);
 exports.hasXConnectObjectHeader = hasXConnectObjectHeader;
 const getVerifierImpl = () => {
@@ -223,3 +237,72 @@ const getVerifierImpl = () => {
     return null;
 };
 exports.getVerifierImpl = getVerifierImpl;
+/**
+ * Returns the headers that must be removed from a request before it is forwarded.
+ *
+ * Requests from authenticated Agents and Peers are trusted and keep their headers.
+ * Requests from the PSTN, and requests authorized only by a Connect Token, are not:
+ * the platform headers in `headers` are removed so a caller can't spoof them.
+ * A client using a verified Connect Token keeps its X-App-Ref.
+ *
+ * @param {RoutingDirection} direction - The routing direction of the request
+ * @param {boolean} withConnectToken - Whether the request carried a verified X-Connect-Token
+ * @param {string[]} headers - The headers to strip from untrusted requests
+ * @return {string[]} The headers to remove
+ */
+const getUntrustedHeadersToStrip = (direction, withConnectToken, headers) => {
+    if (withConnectToken) {
+        return headers.filter((h) => h.toLowerCase() !== common_1.CommonTypes.ExtraHeader.APP_REF.toLowerCase());
+    }
+    if (direction === types_1.RoutingDirection.FROM_PSTN ||
+        direction === types_1.RoutingDirection.UNKNOWN) {
+        return headers;
+    }
+    return [];
+};
+exports.getUntrustedHeadersToStrip = getUntrustedHeadersToStrip;
+/**
+ * Returns the address the request came from: the top Via's "received" value,
+ * which the SIP stack sets when the packet's source differs from the Via host
+ * (RFC 3261 §18.2.1), or the Via host otherwise.
+ *
+ * @param {MessageRequest} request - The request
+ * @return {string | undefined} The source address
+ */
+const getSourceAddress = (request) => {
+    var _a, _b;
+    const via = (_b = (_a = request.message) === null || _a === void 0 ? void 0 : _a.via) === null || _b === void 0 ? void 0 : _b[0];
+    return (via === null || via === void 0 ? void 0 : via.received) || (via === null || via === void 0 ? void 0 : via.host);
+};
+exports.getSourceAddress = getSourceAddress;
+/**
+ * Tells whether a request carrying X-Edgeport-Ref was forwarded by a trusted peer
+ * EdgePort. Only such a request may take the last-message fast path, which skips
+ * routing and access checks. The header value alone proves nothing (anyone can
+ * set it), so the request's source address must be in `trust.addresses`; when
+ * `trust.refs` is not empty, the header value must also be one of them.
+ *
+ * @param {MessageRequest} request - The request
+ * @param {EdgePortTrust} trust - The trusted peer EdgePorts
+ * @return {boolean} true if the request comes from a trusted peer EdgePort
+ */
+const isFromTrustedEdgePort = (request, trust) => {
+    const ref = processor_1.Extensions.getHeaderValue(request, common_1.CommonTypes.ExtraHeader.EDGEPORT_REF);
+    if (!ref || trust.addresses.length === 0)
+        return false;
+    if (trust.refs.length > 0 && !trust.refs.includes(ref))
+        return false;
+    const addr = (0, exports.getSourceAddress)(request);
+    if (!addr)
+        return false;
+    return trust.addresses.some((net) => {
+        try {
+            return common_1.IpUtils.hasIp(net, addr);
+        }
+        catch (e) {
+            // Invalid net, or a source that is not an IP address
+            return false;
+        }
+    });
+};
+exports.isFromTrustedEdgePort = isFromTrustedEdgePort;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@routr/connect",
-  "version": "2.15.3",
+  "version": "2.16.0",
   "description": "Default processor",
   "author": "Pedro Sanders <psanders@fonoster.com>",
   "homepage": "https://github.com/fonoster/routr#readme",
@@ -20,9 +20,9 @@
   },
   "dependencies": {
     "@fonoster/logger": "0.6.0",
-    "@routr/common": "^2.15.3",
-    "@routr/location": "^2.15.3",
-    "@routr/processor": "^2.15.3",
+    "@routr/common": "^2.16.0",
+    "@routr/location": "^2.16.0",
+    "@routr/processor": "^2.16.0",
     "jsonwebtoken": "^9.0.3"
   },
   "devDependencies": {
@@ -41,5 +41,5 @@
   "bugs": {
     "url": "https://github.com/fonoster/routr/issues"
   },
-  "gitHead": "30e73f1331f115b2dd9d02cdfdcf931dbeede36b"
+  "gitHead": "db8a2eeb4b3f57a7f6b632d8d3378ffe53fc6cfe"
 }