- Shipped
- August 27, 2026 at 6:26 PM UTC
- Author
- Kamo
- Commit
- cd11418
All 21 kamocrm team members now hold an 8XXX extension on the k1m1 PBX (Chris renumbered off 7255 to 8134). Two changes here back that. WebRTC endpoint blocks now cover every staff extension rather than the three someone had noticed were broken. The kamo softphone is a browser, so DTLS/ICE is not an enhancement — an extension without a block registers over WS and then has no audio on any call. 8888 had sat unlisted for months. Outbound calling is now permission-gated: only the extensions listed in [kamo-outbound-allowed] reach the trunk. Everyone keeps extension-to- extension dialling and inbound from the PSTN, both of which run through paths this does not touch. The gate lives in [from-internal-custom] rather than on the outbound route because from-internal-xfer includes that context ahead of from-internal-additional, so it sees a dialled number before outrt-1 does. The route's own match_cid column was the alternative and would need one duplicated pattern row per permitted extension, and denies with FreePBX's "cannot be completed as dialed" — a message that sends staff hunting for a typo in a number that was fine. Membership is tested with DIALPLAN_EXISTS against a context of one line per person, so nothing half-matches: 80800 and an empty caller id both deny, which is the safe direction to fail. The three intercept patterns are a mirror of outbound route PrimaryRoiute's dial patterns and have to stay one. Verified on k1m1: all 21 endpoints report ice_support=true, media_encryption=dtls, the WS transport and direct_media=false; all 21 carry the right AMPUSER device and hint keys; the allowed path still resolves to outrt-1 for both domestic and 011 patterns.