3 Commits

Include renames

Author	SHA1	Message	Date
iamdoubz	33d5f1a5f5	web: answer incoming calls from the browser notification ... Owner follow-up to the softphone (spec 05 §5). - the incoming call notification comes from a service worker (public/sw.js) so it carries Answer and Decline buttons (Chromium); Answer and a plain click focus the softphone tab, Decline doesn't - shown whenever the tab isn't focused, not only when it's hidden; kept up while it rings and closed once it stops - the softphone panel says how to allow notifications when they're blocked	2026-10-27 12:35:43 -05:00
iamdoubz	65e777ab41	security: headers, phone ACL, PIN rules for PINs set from the phone ... Headers (08 §2.4) on every response: CSP (connect-src also allows WEBRTC_WS_URL's origin when set), nosniff, Referrer-Policy, Permissions-Policy. The dark-mode bootstrap moved from an inline <script> to /theme.js so script-src stays 'self'. Phone ACL (08 §2.2): with sip.restrictPhonesToLocalNets, every desk extension endpoint gets deny 0.0.0.0/0 and permit for each local and extra net. The spec's snippet was wrong: contact_acl names acl.conf sections, a pjsip type=acl is the global ACL (it would filter trunks), and Contact-header rules let a NATed remote phone through. Browser endpoints come through the reverse proxy and aren't filtered. Golden case phone-acl. Settings → Security holds it, with the provisioning switches. PIN rules for PINs changed from the phone's voicemail menu, which went around the api: externpasscheck = sp-vm-pincheck (in the Asterisk image, same rules as isTrivialPin, a unit test keeps them in step) and minpassword = 4. Accepted PINs reach the api through AMI VoicemailPasswordChange and are stored; before, the next config write silently put the old PIN back. e2e m11-t1: no CSP violations across admin pages; Asterisk refuses a REGISTER ("Not match Endpoint ACL") until the network is listed; from the phone, 1111 is refused by the check script and 7391 is stored and survives a later config write. Task: M11-T1	2026-10-19 14:47:04 -05:00
iamdoubz	964a3c0b25	web: logo on the login page, icon as favicon and in the headers ... public/logo.png is the source; icon-192.png (the mark, cropped and padded on the logo's background) and logo-512.png (login card) are cut from it with ffmpeg so pages don't load the 1.2 MB original. Brand (icon + name) replaces the plain app name in the admin and My Phone headers.	2026-10-19 04:34:08 -05:00