Digest auth-hook for customer BYO-PBX SIP trunks
Internal jambonz client-authentication / registration hook for shared customer-trunks carriers. When a customer PBX terminates an INVITE (or re-REGISTERs) through the shared trunk, jambonz challenges with a 401 and posts the digest claim here. The handler verifies its own HMAC signature, matches the digest username to the per-trunk credentials on organizations.settings.sip_trunks, decrypts the stored digest password, and returns it so jambonz can complete the digest check; every attempt is logged to the per-trunk auth ledger that powers the trunk’s “Recent auth attempts” panel. Not intended for direct client use. Inbound admission only — no outbound signalling (invariant #45).
Authorizations
Dashboard JWT token from Clerk
Body
SIP method being authenticated (INVITE or REGISTER).
SIP realm from the digest challenge.
Digest username claim (chosen by the customer PBX).
SIP URI from the Authorization header.
Challenge nonce.
Digest response computed by the PBX.
Source IP of the PBX, as observed by jambonz.
Response
Authentication verdict. On success returns status: ok with the trunk's digest password for jambonz to verify the claim (plus an optional lifted expires floor for REGISTER); an unknown or misconfigured trunk returns status: fail with a message.