iamdoubz f6a9b9a4b1 calls: limit outside calls at once, per extension and in total ...

Owner's decision after the M11-T8 review: nothing capped how many calls a stolen password could
run at once. Settings → Security: calls.maxPerExtension (3) and calls.maxTotal (10), 0 = no
limit. Each sp-route-* counts the caller's extension (or whose forward it is: SP_LIMITEXT from
sp-sub-forward) with GROUP(spext) and every outside call with GROUP(spout); over a limit the
caller hears "all circuits are busy". 911 is never limited.

trunk-test.ts on a real Asterisk, limits 1 and 2: a 2nd call from 101's phone and a 3rd in total
are refused (with both 0 the same check fails). call-limits.test.ts covers the 0 combinations.
Also fixes the Security tab's hint: browser phones still work from anywhere.

Task: M11-T8

2026-10-20 13:14:20 -05:00

..

src

calls: limit outside calls at once, per extension and in total

2026-10-20 13:14:20 -05:00

package.json

db: drizzle schema matching spec 02, initial migrations, settings service

2026-10-17 15:04:18 -05:00

tsconfig.build.json

workspace: pnpm monorepo with api, web, shared

2026-10-17 14:18:02 -05:00

tsconfig.json

workspace: pnpm monorepo with api, web, shared

2026-10-17 14:18:02 -05:00