Skip to content

fix(sip): reject realm names with hyphens/uppercase; add DNS and cache waits to test workflow - #31

Open
michaela-band wants to merge 1 commit into
mainfrom
feat/sip-provisioning
Open

fix(sip): reject realm names with hyphens/uppercase; add DNS and cache waits to test workflow#31
michaela-band wants to merge 1 commit into
mainfrom
feat/sip-provisioning

Conversation

@michaela-band

Copy link
Copy Markdown
Contributor

Summary

  • ValidateRealmName regex fix — the previous regex allowed hyphens and uppercase letters (DNS label rules), but the Bandwidth API rejects both with error 33013 ([a-z0-9] only). Validation now matches the API constraint, so invalid names fail fast with a clear message before any HTTP request is made.
  • Test update — removed TestRealmCreate_IfNotExistsMatchesNameCaseInsensitively (the uppercase-input scenario it covered is no longer reachable) and replaced it with TestRealmCreate_IfNotExistsRejectsUppercaseName, which verifies validation fires before any API call.
  • AGENTS.md workflow fixes — two gaps discovered during live end-to-end testing of the ephemeral-realm SIP call workflow:
    • New realm FQDNs can take 1–2 minutes to propagate in public DNS after the realm reaches ACTIVE status. Added a dig poll loop after realm creation to block until the FQDN resolves.
    • Bandwidth's SIP proxy caches credential hashes; a freshly created credential fails 407 auth for ~15 s even when the digest response is mathematically correct. Added a sleep 15 after credential creation with an explanation.
  • Fixed the example realm name sip-testsiptest (the hyphen would have failed the corrected validation).
  • Updated the baresip output table to distinguish a repeated-407 credential cache miss from a genuine 403 mismatch.

Test plan

  • make test passes (all packages green)
  • go vet ./... clean (golangci-lint not installed locally; CI will cover it)
  • Manually verified the end-to-end call workflow with the fixes applied — call connected with 183 Session Progress after the 15 s credential cache wait

Note: this PR was substantially assisted by Claude Code. Changes have been reviewed and the test behavior was verified against the live Bandwidth API.

🤖 Generated with Claude Code

…e waits

ValidateRealmName previously allowed uppercase letters and internal hyphens
(DNS label rules), but the Bandwidth API rejects both with error 33013 —
supported chars are [a-z0-9] only. The mismatch caused a confusing runtime
failure after CLI validation passed. Updated the regex and error message to
match the actual API constraint.

The AGENTS.md ephemeral-realm SIP test workflow had two related gaps
discovered during live testing:
- New realm FQDNs can take 1–2 minutes to appear in public DNS after the
  realm reaches ACTIVE status. Added a dig poll loop after realm creation.
- Bandwidth's SIP proxy caches credential hashes; a freshly created or
  rotated credential fails authentication for ~15 s. Added a sleep 15 after
  credential creation with an explanation.

Also fixed the example realm name (sip-test → siptest) which would have
failed the now-correct validation, and updated the baresip output table to
distinguish a repeated-407 cache miss from a genuine 403 credential error.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@michaela-band
michaela-band requested review from a team as code owners August 14, 2026 18:22
@bwappsec

bwappsec commented Aug 14, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants