- Shipped
- September 7, 2026 at 12:05 AM UTC
- Author
- Kamo
- Commit
- 8817254
Traefik sends every path on api.kamocrm.com to this gateway with no path split, and this class forwarded /api/voip/** and nothing else. So /api/bulktext/inbound/{carrier} — written, tested and deployed in VOIPService — was unreachable from the internet: Twilio, Flowroute and Telnyx all posted into a 404 at the edge. The symptom is the one this area keeps producing, which is why it went unnoticed: outbound texts work perfectly and no reply ever arrives, with no error on either side. Only the inbound subtree. Its sibling /api/bulktext/send is the service-to-service transactional send guarded by X-Internal-Auth, and a wildcard over /api/bulktext/** would publish it to the internet — one shared secret between a stranger and every tenant's outbound SMS. That is also why the inbound path was made a sibling of /send rather than a child of it. forwardWebhook rather than forward: it passes the raw body through unread and keeps every header except the auth ones. Telnyx signs timestamp + "|" + body with Ed25519 and Twilio signs the parameters, so a re-serialised body or a dropped telnyx-signature-ed25519 header would fail verification for a message that was perfectly genuine — and VOIPService would answer 403 to a carrier that did nothing wrong. The test asserts all three properties and was probed by renaming the mapping.