This syntax is discouraged, and it is not enabled by default any longer
starting with the 5.36 feature bundles. Stop using it so that we can
eventually bump our minimum required Perl version.
Fixes: Objects::ProhibitIndirectSyntax
Warned-by: perlcritic
Ref: https://metacpan.org/pod/feature#The-'indirect'-feature
Change-Id: I3f89ce74908a896027efa825d90eab3d2e53b1ee
callrecording metakeys such as "uuid" for the involved
call party is present multiple times by nature. the
?subscriber_id= query param will then narrow down the
result. alongside an implicit role filtering
(reseller/subscriber), the sql join and filtering for
the uuid key is present 2 times however, and multiplied
records slip through.
this can be prevented with DISTINCT. to avoid performance
impacts and consider other metakeys orrcuring multiple
times, it will be applied only if a filter is present.
Change-Id: I08047aaee265e2e0a706220e03fd4617da16d33c
admin panel will no longer delete callrecordings for
all parties of the call, but the single subscriber only.
rest-api, behaves the same way, if the ?subscriber_id=
parameter is provided.
when a callrecording is deleted by all call parties,
the remaining records and recording files will be
dropped.
Change-Id: I61f667bdb074a935a8a04473a3685b10e5e09222
The 'Sync Email Templates' button is shown in the Email Templates
page in case some templates is missing for a reseller.
The problem is that the button takes into consideration also
resellers that are already terminated and for which the template
is not needed anymore.
Thus the query has been in fixed in order adding:
r.status != 'terminated'
Change-Id: I2dd551166ae777c8967eae3bda989b669b46b5c0
* timezone field for SubscriberSubAdminAPI form is now Text
instead of +NGCP::Panel::Field::TimezoneSelect because
the template => 'helpers/datatables_field.tt' produces a field
validation error, as well as the Field is designed for UI and not API.
* add validate_timezone() field validation to SubscriberAPI and
SubscriberSubAdminAPI forms.
Change-Id: I6391694284477976d8d6cee71a81e2241bd94937
In commit b51c0c9698 the possibility to change the 'cli'
preference by subscriber and subscriber_admin was added
(under certain limits).
On the other hand, the additiona of that part of code
broke the possibility to remove the preference using
the PATCH api. It is a very uncommon scenario though,
but it seems anyway used by some customer.
We may think to deprecate this possibility one day,
but till then we don't have to create regression
to customer.
Change-Id: Ie695b567929eb79b1ba63d3c5a31ae5ce7b559bd
Administrators with reseller role were not able to create new
subscriberprofiles because API was fialing with 500 error.
In particular:
LOG="«DBIx::Class::Row::store_column(): No such column
'reseller_id' on NGCP::Panel::Model::DB::voip_subscriber_profiles
at /usr/share/perl5/NGCP/Panel/Controller/API/SubscriberProfiles.pm
line 172»
The error was caused by the addition of the reseller_id info
in the $resourse even if not needed.
Change-Id: I7970a2716d7af959639937a9a844160ab73a9176
* default_val is now correctly accepted as either 1/0 or true/false
* fix 500 error when default_val is provided as JSON true/false
Change-Id: Id6db9c13ae458ddd61e5a68865249eb4e3e124bf
* perform_auth $realm is in a form of a subrealm, e.g. api_admin_http
api_admin_jwt, etc. where for bans check it's 'admin' realm.
Therefore, user_is_banned() is now called from there using explicit
'admin' realm as the argument.
Change-Id: I3a10a9b492bf9dbe83ddd34a8851e83b23f90587
* the new endpoint accepts new_password fields and enables
for authenticated user a mechanism to quickly change their password
* the global password validation rules are enabled
* returns 204 No Content
* if user's password is expired, the endpoint is the only accessible
for the user to change the password and unlock other endpoints.
* a few fixes in validate_password() to correctly fetch provisioning
subscriber for password change scenarios and webpassword field
Change-Id: I906fcfe5c780b850d322b46b445b54c054767673
* max subscribers/group license check is invoked only on POST
to enable clients to modify existing entries even if the threshold
is reached.
Change-Id: I858b42ada5c95c179f901e43837b15358027011b
* 403 Password Expired is now correctly returned for
POST /login_jwt when a password is expired, instead of
returning the token.
* 403 Password Expired is now correctly returned for API requests
and redirect to /changepassword only happens for non API requests.
* improve Utils::Auth::check_max_age() to accept also $auth_user and
$ngcp_realm for cases (like /login_jwt) where there is an
authenticated user but there is no $c->user.
Change-Id: I302ad8654bdf16fe0882625fd6e9a8bba7a8ad42
* device_id, profile_id (device related), config_id are now
expandable in the respective /api/pbxdevice* endpoints.
* fix expand collection logic to avoid ambiguous 'order by id'.
Change-Id: I0b1f4b3da093fb04a30e5097881af6131c1afe46
* UI: password are now validated against
$c->config->{security}{password}{web_max_age_days} (unless it's 0)
and if the password is expired the user is redirected automatically
to /changepassword page, and after successful password change back
to the original page.
* API: if password is expired all API requests will be returning
403 Forbidden "Password expired", except PUT/PATCH to /api/admins
or /api/subscribers with the new password in place.
* successful login on the UI now redirects to /dashboard instead of
/ (to prevent unintended redirect to v2)
Change-Id: I075f8e17cc9b0658d6b3b3d526ca5b379d050ce4
In some cases the UI requires to GET information from a specific
reseller or billing profile because needed to show/created other
endpoints (for example 'customers').
Due to that it has been added the possiiblity to do the GET not
only of the list of the resellers and biling profiles, but also
of each specific item.
Change-Id: Iebbbbc494ce71e616d8e41ca20e97bebce7998b8
* subscriber login attempts without Basic Auth are now
correctly intercepted and returned as 403 Forbidden
Change-Id: I3deb60d8ac4f107bccd6422d27426e39a39e50f1
* the relevant max license checkes are moved from
Controller::API::Subscribers::POST to
Utils::Subscribers::prepare_resource because there we fetch
customer_id from the pilot subscriber in case of pbx subscriberadmin
requests that is neccessary for PBX subscribers max license check.
Change-Id: I2d1c212d73fe5b9295d1595b4fffebeb67b61e5a
* perform_subscriber_auth(): check if domain is undefined
and use only $user, otherwise $user . @ . $domain.
Change-Id: I3d342fb2c4768c2b7b3e0c08ea41e429b83e9683
* users are now progressively banned.
* ban_min_time is used to ban a user for the first time.
* consecutive ban is ban_min_time + ban_increment * ban_increment_stage
* ban_max_time is the absolute maximum ban time that is not increased
any further.
* a successful login resets the ban_increment_stage.
Change-Id: I4d7e1a93d7a21d21a0dcf69d856a872d2ed75ea0
* correctly detect and skip password validation when
sip_validatation or web_validation is not enabled respectively
* better detect web password for admin users
* /api/admins PUT/PATCH now also correctly checks last used passwords
Change-Id: I9a6fa9b8e30ae2b81d2852dec0e1f9d858be13ef
* users for admin/subscriber realms are now banned if failed
to login X amount of times (UI/API).
* rework Redis connection and it's now a Catalyst plugin NGCP::Redis
accessed by $c->redis_get_connection({database => 19}), the connection
per database, per worker process is established only once and then
reused (with auto built-in reconnect support).
* remove Utils::Redis.pm as it does not have any code/logic anymore.
* ban values are taken from $config->{security}{login} as
- ban_enable: 1
- ban_expire_time: 3600 ban expire time in seconds
- max_attempts: 5
* if max_attempts set to 0, the ban functionality is disabled as it
requires to be at least 1 to work.
* upon successful login or ban, the failed attempts counter is removed
* the failed attempts counter is also removed automatically with the
expire time equals "ban_expire_time" or otherwise 3600 seconds.
* user bans are logged into panel.log
* banned user receives exactly the same return page/codes as per
invalid logic.
Change-Id: I05cc68c623ee289488fc64f1af50527004dcaae1
* passwords are now validated based on
- minlen
- maxlen
- min lower case chars
- min uppper case chars
- min digits
- min special chars
* Data::Password::zxcvbn is used to calculate
password score and reject passwords with score < 3 as weak
(this library is ported from the Dropbox password validation)
* Add password journals and check last used passwords in the journals
* Improve password generator javascript function to generate a password
with at least 4 of each of the char group types.
* Currently affected are subcriber and admin entry creation or
modification via UI/API
* NGCP::Utils::Auth add optional bcrypt_cost support as last argument
for generate_salted_hash and get_usr_salted_pass
Change-Id: I100c25107d91741d5101bc58d29a3fa558b0b017
* max_subscribers, max_pbx_subscribers, max_pbx_groups license
checks are added for subscriber/group creation in UI/API
* new accessor $c->license_meta that returns meta license
flags hashref
* new accessor $c->license_max_subscribers
* new accessor $c->license_max_pbx_subscribers
* new accessor $c->license_max_pbx_groups
* the new accessors (except license_meta) return -1
instead of 'unlimited' to ease off comprarsion
* 403 Forbidden is returned by the API if a license
is violated.
Change-Id: I3f5a949efc84bf85b76b33404b37b362ec484d5f
* UI and API parts are now under license control
* new Util::License::get_license($c, $name)
- fetches license status by name (1 if enabled, and also if
/proc/ngcp/check if 'ok')
* add Catalyst::Plugins::NGCP::License with license($name)
to fetch valid license by name from anywhere using
$c->license('pbx') or from the templates using c.license('pbx').
It internally uses Util::License::get_license($c, $name)
* License::get_license_status($c) now requires $c as first argument
as well logs license status check errors.
* new ActionRoles::License that enables usage of
:Does(License) RequiresLicense('pbx') LicenseDetachTo('/denied_page')
in the Controller chains
* Add license control for UI elements and return 403 Forbidden
if a resource is covered by licenses and the license is not active
* Hide UI elements if a license is not active
* API/Entities/Entities new $c->set_config key:
- per endpoint:
$c->set_config({
required_licenses => [qw/pbx device_provisioning/]
}
- or per method:
$c->set_config({
required_licenses => {
POST => [qw/pbx device_provisioning/]
}
}
}
* In case if an API endpoint does not have a license:
403 Forbidden "Invalid license" reply is returned.
* Add license based restrictions to API endpoints
* /api documentation:
- completely hide endpoints that do not have an active license
- hide only methods that does not have an active license
Change-Id: Iba45fc5068b02306a617fed7b5405f2210574b61
inbound/outbound no longer represent the "full" direction and belong
only to A leg, so they are renamed to a_inbound/a_outbound accordingly.
Change-Id: I639b799c3649c9b3ca78eee831b49ef0cfa14287
item (contract, contact, subscriber) lookup will pick the first
matching element (an arbitrary one if multiple are matching).
ie. when lookup identifiers are too loose (f.ex. subscribers
without domain in a multidomain setup) it might pick a wrong
item - which is ok (supposed to bail out at a later step)
unless that wrong item is a *terminated* one, causing to
proceed checks on a terminated record (which can never
happen from API or UI side since those hide terminated items),
which produces a misleading 500 error in the end.
we prevent this now by ensuring that looked up items are
not terminated ones. even if the looked up items is not
the desired one, becasue of an inaccurate template.
Change-Id: I6691937c2e62b05915c7eac9980224abe2185b2c
This is needed to perform manipulations to the SIP message
just before it leaves the system on the B-Leg side.
Change-Id: If93d0277582a086253b84088a93adc4ecfa187b1
* new Utils::License::get_license_meta($c) to
fetch license meta ({} by default) that contains license
related metadata such as current and max amount
of subcsribers and license valid until date.
currently the following data is fetched from /proc/ngcp
check
current_calls
current_pbx_groups
current_pbx_subscribers
current_registered_subscribers
current_subscribers
license_valid_until
max_calls
max_pbx_groups
max_pbx_subscribers
max_registered_subscribers
max_subscribers
valid
* Controller::API::Root platforminfo now also returns
license_meta
Change-Id: I323cdfd646335a408e0150ecd69ad950fa0461ab
* add search by not_null for fields that ends with _id
and integers, that adds "IS NOT NULL" to the SQL search query
by the field.
* null and not null values are expected now as $null and $not_null
to avoid conflicts when user searches by null strings that may
be a valid case.
Change-Id: I8e8b8c9060e985dfe2b94cbfcca1587f05477fe9
* NGCP::Utils::License new function get_licenses()
that reads /proc/ngcp/flags/ and returns all files
with content 1.
* api/platforminfo.tt template now calls a stashed
callback (coderef) that decodes provided json file,
includes licenses and returns encoded the json back.
* ngcp-panel.service changes
# Files + directories not directly associated are made
invisible in the /proc/ file system
# ProcSubset=pid
# Disabled: MT#58964, to be able to read /proc/ngcp/flags/
# Processes owned by other users are hidden from /proc/
# ProtectProc=invisible
# Disabled: MT#58964, to be able to read /proc/ngcp/flags/
Change-Id: I84b6707a918e3f4f271e32b9353f320753c5ae68
* customer_id search param now has the same search logic
as the rest as it had before 'null' detection and conversion
=> 'undef' whereas it's not needed anymore because it's now
supported globally. The change also fixes an empty response
issue.
Change-Id: If95de44d16ca2871da72d0ee019850802a3a94dd
* resellers should be able to create/update and delete
NCOS LNP Carrier entries using exising LNP Carriers.
Change-Id: I85d900c194d46af8d888e2f854729a3ca52711fe
* fix reselelr_id for 'reseller' role and it's now
automatically set to the user's reseller_id instead of
throwing a validation error
Change-Id: Ic732366aea6c4106c37961e599cd1e40fdaba5b2
* reseller role can use GET on the endpoint because
it is needed for an NCOS Levels (which resellers can create).
Change-Id: Ic793b0d74e767eb9e150a6ae3c67ff9f51c8cf6c
* search by value null is internally translated to undef
to say search for records without a value, same way as
it already works for NULL value, just null is more expected
and easier to use by clients as it's how its represented in the
resource
Change-Id: Ia8a75bad95a34dd8167162d0f09a1ec7c4056105
* in general expand collection now performs only 1 sql
query to per expand field to fetch all items by the ids
instead of fetching them for every single collection item,
that should significantly increase performance in case
of large databases and reduce work for the database
* introduce $c->stash->{expand_cache} that contains
cached data for the expand fields to avoid multiple
same calculations
* expand_field() and expand_field_data() have been reworked
to support expand_cache
* new method expand_prepare_collection() is called for all
API GET collection methods before preparing resource hal
fields, to change the expand logic to only cache the data
instead of fetching it from the database
* new method expand_collection_fields() that is called in all
API GET collection methods after the @embedded data is prepared
to finalise the expand collection fields
* for expand collection there is only 1 SQL request per expand field
that fetches all items -in [ids to expand] and then the
expand_collection_fields() uses the cached items_by_ids with
O(1) fetch from the cache by id
Change-Id: Ie7c6115472878febf0d8c9b4d833f5c23b15c78b
* subscriberadmin roles can now handle customer preferences
belonging to the same customer and only those with
expose_to_customer = '1'
Change-Id: Iae9ab5d4a96a065b1a627d180dd523e805d954f3
* disable active state checks for subscriber and subscriberadmin
roles in mailtofaxsettings because they can now change it similar
to how they could do it in the old csc.
Change-Id: Ica8039e83d2acc5e162c7902afcd4b97ac1c5b6d
* subscriberadmin and subscriber can now use /api/mailtofaxsettings
* adapt item_rs query for subscriberadmin and subscriber so that
subscriberadmin can have access to all 'own' subscribers
Change-Id: If8e768c5c06bc4e5f0a6ef9d15e19f542d8b6a4d
* if Accept: applicaton/json header is provided for API
request - the response's Content-Type header is set to
application/json. The return content in this case is preserved
as HAL but it's helpful for the clients that only expect
aplication/json response Content-Type
Change-Id: I8c60da4df7d639f45953d8ace699a59fefc88ddf
* consider as the "same number" if old/new primary numbers are empty
(undefined in the database as if a primary number exists at least cc
and sn are mandatory).
* check for new primary number "cc" existence when preparing comparsion
to the existing primary number, as some clients may send an object
value with null cc+ac+sn.
Change-Id: I810cda7d7aa07f2d7e46dbca099bc327ef7b4963
creating or updating subscriber (-aliases) will
modify the allowedcli (acli) preference, if the
auto_allow_cli config option is set. the primary
number will also be part of the acli list.
when specifying ?create_primary_acli=false or
?create_primary_acli=0, the primary alias will
no longer be added to acli.
Change-Id: I4641e2b973de2afe2e36805140b1546cac2a699a
This new flag controls wether the CF is processed as usual
(flag with value 0, default) or generates a 302 redirect message
back to the caller (flag with value 1).
The implementation cover both the UI and the API.
Change-Id: Idf945262e17de0d77bb612101d268fd6ea7a309e
s/paramaters/parameters/
s/wihout/without/
s/If it mathes/If it matches/
s/ in in / in /
s/the the/the/ (note: fixes translation issue which was introduced with
commit 2b7a1a33 and fixed in 072e897c for the original, but missed
for the german translation)
Change-Id: I4186bf3f42b1fac11bb7d7fe801f860d2d59adc1
* POST /api/subscribers/ invoke lock_provisioning_voip_subscriber()
before underrun_lock(), so that if the subscriber is about
to be locked due to customer balance costs, the
lock_provisioning_lock_subscriber() invocation will not unlock it
back straight after
Change-Id: I55020f844c9aa76df2e2f057a88b2ae7c9ebbfcc
* billing fees relation was rendering all associated billing fees
and that was causing huge data sets to be returned if a billing
zones had many fees, now instead a single link is returned
/api/billingfees/?billing_zone_id=:id. this is also on par
with other links like /api/billingfees/:id
Change-Id: Iabb7afb3bf43abf9a22c71750d45a1962a7f16ec
Using API is possibile to edit an existing subscriber and set
status: active and lock: 2.
It is instead impossbile to create a new subscriber with the same
configuration because the 'lock' param is not taken into account.
The only way to properly setup lock level it is to set the status
to 'locked' and this is in fact wrong.
The fix address this issue and allow now to create a new subscriber
with status: active and lock: 2.
Change-Id: Id18e40bc001c5a7de30f5d148231bda93a3b1b3d
* Entites logic is used for GET/POST/PUT/PATCH/DELETE
* Utils::CallForwards::check_destinations() do not obfuscate
destinations that are returned in the response as all
logged data is obfuscated anyways
Change-Id: Ia79f9e236c966410e2640d719c3a7f5784cc4c2a
* additional $c->has_errors checks for post/patch/put/delete to
cover all possible expected called inherited methods scenarios
and returns.
Change-Id: I0e09ba62bcaa51d582315d9cbb672a4cf11bacf0
* /api/cftimesets now fully use Entities/EntitiesItem
* EntitiesItem: delete(): fix delete_item() expression processing
* Entities/EntitiesItem: post/put/patch/delete: go to TX_END
in scenarios where after a method call (e.g. update_item()) there
is a normal return from the function but errors in $c->error, so
that they are also caught correctly
Change-Id: I3bef409ded590796c2bba4f30acd28b02e99065b
* clear errors in Controller::API::Root::end so that they are
not interfere with generated ones
* API::error(): add $c->stash->{is_api_error_response} = 1
to track it in log_response()
* API::log_response(): distinguish and correctly correct errors
for cases when is_api_response == 1 and also when there were
$c->error('error') calls in the code, to log them correctly
in both cases
Change-Id: Id922b8219832c1b99815d9d608309035b9b25cff
* the error produced by item_id_is_valid() is returned instead of
a new one is generated
* fix incorrect expression on delete_item() in delete()
Change-Id: Ic8e4e24c70bbcd99ec414d901eb2842ee39ae7de
* fix resultset when user role is reseller so that reseller_id
is joined correctly and a db error is not produced anymore.
Change-Id: I2a1b357037d983f23770bb59519fc2cb8b68a7e4
* $c->error array now contains the $message as the first element
instead, so that it's possible to obtain all the error data in
the code when fetching it from @{$c->error}. the first element
is not logged in the error log.
* api_response $c->response_body part is now stored in MSG= and
possible errors / other log data is now stored in LOG= to:
- reduce amount of log lines when an API error response occurs
from 2 to 1
- the message part usually contains either HTTP response
message (e.g. Internal Server Error) or a validation message
string, so it belongs to the MSG= part of the log line, where
as the internal log data is more related to the LOG= part
- both MSG= and LOG= parts are escaped for GDPR related obfuscation
* Utils::Messag::info(): $msg is now also obfuscated if it's detected
as a reference (also because logging is moved for the API part to
$msg), as well as truncated for possible new-line char and
white-spaces.
Change-Id: I3b670b2251ec3060037ed6863f18d95975120b8d
* the following changes resolve an issue where $now in Role/Contracts
resource_from_item appeared as an object and failed subsequent
logic:
- hal_from_contract is renamed to hal_from_item to match correctly
the parent method
- call hal_from_item and pass $now string there correctly as $params
{ now => $now }
Change-Id: I5c02d5f7df5d9000550505ad120b9531f87e8d65
* Role/Entities*: POST/PUT/PATCH/DELETE methods changes:
- support deadlock detection and transaction retry
(2 retry attempts at the moment)
- improve transaction control, use local $guard
instead of saving the ref to $c->stash, as in that
case it went out of scope too late and also reported
an error message into the log about abnormal $guard out
of scope interruption
- move all non transaction related code outside
of the scope
- add error handling when methods such as update_item,
and a like do not return the expected data, instead of
simply going out of scope and resulting in an uncontrolled
reply
* Role/API:
- rework transaction control:
+ get_transaction_control() is renamed to start_transaction()
to better reflect what it does
+ complete_transaction() is renamed to commit_transaction()
+ remove unused %params arg
+ pass $guard into commit_transaction() instead of having it
stored as $c->stash->{transaction_guard) that caused the $guard
ref to be destroyed much late than expected
(there was also a typo as transaction_quard,
which is not relevant anymore with the changes
+ add check_deadlock() that is invoked when an exception is caught
or an $c->errors contain an error, and if the error message
represents a transaction error, the transaction block is
re-invoked via "goto TX_START"
- rework error():
+ it now accepts args as following:
($self, $c, $code, $message, @errors)
# code -> returned as HTTP code in the reply
# message -> returned as HTTP message in the reply
# errors -> contain errors for internal logging, last element often contains a DBIx exception
+ populates all @errors into $c->error so they are available on
demend in the code via $c->error or $c->last_error
+ $c->log->error is not invoked now as the errors become printed
in log_response()
- log_response() now prints collected errors from $c->error correctly
as a separate log line, that is alike to the other api logs so that
those can be looked up by the request's tx_id, also all errors are
now printed only into api.log
* Adjust all $self->error() calls in catch($e) to include $e as the last
argument, as well as the duplicate $c->log->error is removed from
those ocassions
* Remove all $c->log->error() calls as they are replaced with either
$self->error() (that logs it correctly into api.log) or
$c->error('err') that also adds it correctly into api.log
* API::CallForwards: rework to use Entities/EntitiesItem
* API::Contracts: rework POST to use Entities
* API::PeeringGroups: rework POST to use Entities
* API::SubscriberRegistrations: rework POST to use Entities
* API::RewriteRuleSets: improve create_item() functionality
* Utils/Message: add 'api_retry' log type
* $c->session->{api_request_tx_id} is changed to
$c->stash->{api_request_tx_id} because sometimes the session
ref is different and a different tx_id becomes used
Change-Id: I633ce7a8047b1bf00a2f6889003088edf0825dcd
* POST /api/headerrules now supports either 'set_id' or 'subscriber_id'.
When 'subsriber_id' is specified, a subscriber assigned header rule
set is automatically created if it does not exist, as well as
automatically removed when its last header rule is deleted.
* It is now possible to directly GET and DELETE /api/headerrules/:id
where :id is a subscriber assigned header rule.
* It is now possible to directly GET and DELETE /api/headerrulesets/:id
where :id is a subscriber assigned header rule set.
* Improve /api/headerrules data validation and duplicate header rule
detection.
* It is now possible to expand by /api/headerrules/?expand=set_id field
Change-Id: I681bc61c2eed47a8e54847f07f31134f643930c2
* if the primary numner during /api/subscribers update request is
unchanged, the primary number processing related logic is not invoked,
as otherwise it's a redundant and in some cases (pilot subscriber)
time consuming operation.
Change-Id: I4cbb0387011f5241fcbdaab1efbb0d4a5caa2143
all api query param filters that were harmonized to "wildcard"
also appended leading+trailing wildcard (this was from the original
idea to make adminUI and legacy panel search behave the same).
Change-Id: I017473b84f2844d14a11b4ec8b437df5335c24d0
this filter is another spot, where leading/trailing wildcards
were added unintentionally, during harmonization.
Change-Id: Id23114f8e7ebca018ad222e35b39d8260f1da92f
* socket field is changed to text for the API endpoint as by default
in the LocationEntry form that is used by the UI the field is
a prebuilt options list that comes from config.yml extra_sockets,
and that severely limits the usage for the API.
Change-Id: I71ee1f77dbf458c12655f840282375cee62b7534
* if no balance is found for the provided period a 422
error is returned:
showdetails => $c->loc('period start=[_1] end=[_2].', $stime, $etime),
error => 'Could not find active balance.',
httpcode => HTTP_UNPROCESSABLE_ENTITY,
instead of a 500 server because of access to undefined $balance value
Change-Id: Icccb9f253d117327641b6803ac0d2cdb09cf030f
in case the DB shows discrepancy because of missing
primary provisioning.voip_dbaliases records, align with
legacy panel behaviour and also take the restapi
aliases list from voip_numbers, instead of voip_dbaliases.
.. while trying to keep the performance gain from
https://gerrit.mgm.sipwise.com/c/ngcp-panel/+/65086.
Change-Id: Ibd7f8c8bc6a39ae2c31b4e8818080674ab77d66c
* /api/rewriterules PATCH, DELETE methods used the generic
transaction, which conflicted with the xmlrpc reload command.
* own_transaction_control was only set for PUT and now also
extended to PATCH, DELETE to ensure that dialplan_sip_reload()
is called properly after $guard->commit.
Change-Id: I7313b4f6d1f6699bf38ae34749c5383a3943f61d
with the change to harmonize wildcard symbols % and *
to * in query param filters across all restapi rails,
only
- /api/subscribers?alias=
- /api/subscribers?pbx_extension=
- /api/subscribers?primary_number=
- /api/pbxdevices?pbx_extension=
are supposed to include implicit leading an trailing
wildcards.
panel UI uses trailing wildcard by default everywhere,
and so should the databales of the new Admin UI.
external_id were used to support patterns, but must
not include a trailing wildcard in rest API, as this
can break logic that rely on unique api request results.
we now therefore no longer append wildcards in particular to:
- /api/voicemails?folder=
- /api/voicemailgreetings?type=
- /api/subscribers?subscriber_external_id=
- /api/subscribers?customer_external_id=
- /api/subscribers?display_name=
- /api/subscribers?domain=
- /api/profilepackages?profile_name=
- /api/profilepackages?network_name=
- /api/pbxdevices?display_name=
- /api/faxserversettings?name_or_password=
Change-Id: I40ef1912d7224a56c6d14619d258c70e447ab23d
the /api/callists rail supports the "call_id" query parameter to match calls with a callid prefix. this filter also adds an implicity ordering ORDER BY length(call_id) ASC, 'start_time' ASC.
the /api/callists api rail also requires the query parameter "susbcriber_id", which renders a (fast) compound SQL query to list matching incoming (query1) and outgoing calls (query2) using UNION ALL (instead of a slow OR query).
query1 UNION ALL query2
this is supported by the https://metacpan.org/pod/DBIx::Class::Helper::ResultSet::SetOperations module, which however generates invalid SQL syntax if query1 or query2 contains an ORDER BY.
this is exactly what caused the 500 error of the customer who applied both "call_id" and "susbcriber_id" parameter in the request at the same time.
... ORDER BY length(call_id) ASC, `start_time` ASC UNION ALL SELECT `me`.`id`...
the error happens randomly, because query parameters are stored in a hash (which by definition has no deterministic order of the entries). when the "call_id" parameter is applied at last, it worked as expected.
so the issue can be adressed by strictly ordering the UNION ALL result, and prohibit ORDER BY in query1 and query1. the latter was added already with commit b2dfe28eed, and could be hotfixed.
however, the ORDER BY of "call_id" query param is lost, and should be properly handled by forcing strict ordering of how query parameters are applied.
the fix will introduce paramater ordering according to their order of definition in the code.
Change-Id: I165d341b5c20e9bb750bd1fba88c836b393e80bd
* get_handlers_rs() is renamed into get_file_handles() and
reworked from an indented 'from' resultset into 2 separate
resultsets, one fetching all the handles and another one
files for the sound set, it is now returned as an array with the
similar data. Reason for this rework is the deprecated use of
'from', that resulted in a lot of warnings in panel-fcgi.log:
DBIx::Class::SQLMaker::ClassicExtensions::_join_condition():
ResultSet {from} structures with conditions not conforming to the
SQL::Abstract::Classic syntax are deprecated: you either need to
stop abusing {from} altogether, or express the condition properly
using the { -ident => ... }
* adjust file_handles data key names to better follow the
naming conventions and readability, e.g.: groupname -> group_name,
fileid -> file_id
Change-Id: Ia91c9104c0b4dc79ee5bc359eb0b6e035e56ef3e
* the expected csv fields are as following:
- /api/resellerphonebookentries/?reseller_id=1
name,number
- /api/customerphonebookentries/?customer_id=1
name,number
- /api/subscriberphonebookentries/?subscriber_id=1
name,number,shared
- /api/resellerphonebookentries/
name,number,reseller_id
- /api/customerphonebookentries/
name,number,contract_id
- /api/customerphonebookentries/
name,number,shared,subcriber_id
(note: the fields are taken from the leftmost side
as the minimum required fields, so if one provides as:
- /api/resellerphonebookentries/?reseller_id=1
name,number,reseller_id
this line will be uploaded and columns after 'number' are
ignored in this case.
this is for convenience if you have a prepared upload
for different customers/resellers for instance, you can
upload it under one customer/reseller when needed
* user access scope is now validated, e.g.:
resellers cannot upload phonebook entries to another resellers,
etc.
* fix csv upload for /api/customerphonebookentries/?customer_id=1
Change-Id: I970ac36fdb8b366adff15515a48d296e8abeff13
* {"values:", ["value1", "value2"]} is not accepted by
/api/headerruleconditions
* the previous behaviour of {"values": [{"value": "value1"},{"value":
"value2"}]} is preserved
Change-Id: I7d9540d20ed0ecbb2712f1905a7d9e6f7af7e06d
* add global expand by rwr_set_id field
* adjust rwr_set_id, rule_id in Condition and Action forms
to have correct type (as they were inherited as Hidden)
Change-Id: Id2529c67919b496303cee24da2a2c63f22df23e9
Rene Krenn
Guillem Jover
Marco Capetta
Kirill Solomko
Donat Zenichev
Michael Prokop
Sipwise Jenkins Builder