SIP REGISTER digest auth-hook for softphone credentials
Internal jambonz REGISTER auth-hook. jambonz calls this on every SIP REGISTER from a softphone (or a BYO-PBX endpoint) to fetch the digest A1 hash it needs to verify the challenge. The handler looks up the tenant_sip_credentials row for the supplied username, enforces the realm, the per-credential enabled/expiry state, the user-agent and CIDR locks, and the per-extension registration cap, then returns the A1 hash for the challenged algorithm (falling back to an incoming customer-trunk digest password when the username belongs to a trunk). Signed with the jambonz webhook HMAC and not intended for direct client use. Inbound admission only — no outbound signalling (invariant #45).
Authorizations
Dashboard JWT token from Clerk
Body
Digest username from the REGISTER Authorization header.
Realm jambonz used to compute the digest; must match the configured SIP realm or the SIP-edge host.
Digest algorithm jambonz challenged with (MD5 or SHA-256).
Source IP of the registering endpoint.
User-Agent header of the registering endpoint.
Response
Authentication verdict. On success returns status: ok with the A1 digest hash (or the trunk password) jambonz uses to verify the challenge; a rejected credential returns HTTP 401 with status: fail and a machine-readable reason.