From 5f10ef585f7a926c0c050a4f921756d6c60953ca Mon Sep 17 00:00:00 2001
From: Dave Horton <daveh@beachdognet.com>
Date: Fri, 19 Feb 2021 11:47:03 -0500
Subject: [PATCH] REST createCall must use absolute url in call_hook and
 call_status_hook

---
 lib/routes/api/accounts.js | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/lib/routes/api/accounts.js b/lib/routes/api/accounts.js
index afa8a03..3ac5cd3 100644
--- a/lib/routes/api/accounts.js
+++ b/lib/routes/api/accounts.js
@@ -131,8 +131,34 @@ async function validateCreateCall(logger, sid, req) {
     });
   }
 
-  if (!obj.call_hook || (typeof obj.call_hook === 'object' && !obj.call_hook.url)) {
-    throw new DbErrorBadRequest('either url or application_sid required');
+  if (!obj.call_hook && !obj.application_sid) {
+    throw new DbErrorBadRequest('either call_hook or application_sid required');
+  }
+  if (typeof obj.call_hook === 'string') {
+    const url = obj.call_hook;
+    obj.call_hook = {
+      url,
+      method: 'POST'
+    };
+  }
+  if (typeof obj.call_status_hook === 'string') {
+    const url = obj.call_status_hook;
+    obj.call_status_hook = {
+      url,
+      method: 'POST'
+    };
+  }
+  if (typeof obj.call_hook === 'object' && typeof obj.call_hook.url != 'string') {
+    throw new DbErrorBadRequest('call_hook must be string or an object containing a url property');
+  }
+  if (typeof obj.call_status_hook === 'object' && typeof obj.call_status_hook.url != 'string') {
+    throw new DbErrorBadRequest('call_status_hook must be string or an object containing a url property');
+  }
+  if (obj.call_hook && !/^https?:/.test(obj.call_hook.url)) {
+    throw new DbErrorBadRequest('call_hook url be an absolute url');
+  }
+  if (obj.call_status_hook && !/^https?:/.test(obj.call_status_hook.url)) {
+    throw new DbErrorBadRequest('call_status_hook url be an absolute url');
   }
 }