iamdoubz
60846afddd
API tokens (Settings -> API tokens): Authorization: Bearer sp_<40 base62>, stored as sha256, shown once. A token acts as its admin with their current role and stops when they're disabled; Bearer requests skip the CSRF header and never fall back to the cookie. A token can't manage tokens. Webhooks (Settings -> Webhooks): call.started/answered/ended, voicemail.new, emergency.call, trunk/extension registration changes, from the live state; queued per webhook, sent every 10 s with X-SelfPhoneNG-Signature (HMAC of timestamp.body), retried after 1 m, 5 m, 30 m, 2 h, 12 h, then failed. Private/loopback targets are refused in the connection's own DNS lookup (no rebinding), unless allowed. Send test and a delivery log per webhook. The e2e found voicemail.new missing for mailboxes without a user: the voicemail scan now queues it for every mailbox. vmpin.test.ts gets 180 s: Git Bash forks make it ~85 s on Windows (the earlier flaky gate run). Task: M11-T5