fix soniox stt speech credential validation (#535)

* support google gemini tts

* wip

* wip

* wip

* wip

* wip

* support speech utils

.github/workflows/ci.yml

@@ -6,22 +6,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Docker Compose
         run: |
           sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
           sudo chmod +x /usr/local/bin/docker-compose
           docker-compose --version
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: lts/*
       - run: npm install
       - run: npm run jslint
-      - name: Install Docker Compose
-        run: |
-          sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-          sudo chmod +x /usr/local/bin/docker-compose
-          docker-compose --version
       - run: npm test
       - run: npm run test:encrypt-decrypt
 

.github/workflows/docker-publish-dbcreate.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: prepare tag 
         id: prepare_tag
@@ -37,14 +37,14 @@ jobs:
             echo "image_id=$IMAGE_ID" >> $GITHUB_OUTPUT
             echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Login to Docker Hub 
-        uses: docker/login-action@v2
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile.db-create

.github/workflows/docker-publish.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: prepare tag 
         id: prepare_tag
@@ -37,14 +37,14 @@ jobs:
             echo "image_id=$IMAGE_ID" >> $GITHUB_OUTPUT
             echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Login to Docker Hub 
-        uses: docker/login-action@v2
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true

db/jambones-sql.sql

@@ -707,6 +707,10 @@ CREATE INDEX sip_gateway_idx_hostport ON sip_gateways (ipv4,port);
 
 CREATE INDEX idx_sip_gateways_inbound_carrier ON sip_gateways (inbound,voip_carrier_sid);
 
+CREATE INDEX idx_sip_gateways_inbound_lookup ON sip_gateways (inbound,netmask,ipv4);
+
+CREATE INDEX idx_sip_gateways_inbound_netmask ON sip_gateways (inbound,netmask);
+
 CREATE INDEX voip_carrier_sid_idx ON sip_gateways (voip_carrier_sid);
 ALTER TABLE sip_gateways ADD FOREIGN KEY voip_carrier_sid_idxfk_2 (voip_carrier_sid) REFERENCES voip_carriers (voip_carrier_sid);
 
@@ -748,4 +752,4 @@ ALTER TABLE accounts ADD FOREIGN KEY device_calling_application_sid_idxfk (devic
 
 ALTER TABLE accounts ADD FOREIGN KEY siprec_hook_sid_idxfk (siprec_hook_sid) REFERENCES applications (application_sid);
 
-SET FOREIGN_KEY_CHECKS=0;
+SET FOREIGN_KEY_CHECKS=1;

db/jambones.sqs

@@ -2378,7 +2378,7 @@
         </location>
         <size>
             <width>391.00</width>
-            <height>300.00</height>
+            <height>340.00</height>
         </size>
         <zorder>7</zorder>
         <SQLField>
@@ -2508,6 +2508,46 @@
             <indexNamePrefix><![CDATA[sip_gateways]]></indexNamePrefix>
             <uid><![CDATA[BCE047C6-F70E-42AD-9201-FECF1BAD6BEA]]></uid>
         </SQLIndex>
+        <SQLIndex>
+            <name><![CDATA[idx_sip_gateways_inbound_lookup]]></name>
+            <fieldName><![CDATA[inbound]]></fieldName>
+            <fieldName><![CDATA[netmask]]></fieldName>
+            <fieldName><![CDATA[ipv4]]></fieldName>
+            <SQLIndexEntry>
+                <name><![CDATA[inbound]]></name>
+                <prefixSize><![CDATA[]]></prefixSize>
+                <fieldUid><![CDATA[CDE029DC-0C7C-400C-85E9-5005C53B7460]]></fieldUid>
+            </SQLIndexEntry>
+            <SQLIndexEntry>
+                <name><![CDATA[netmask]]></name>
+                <prefixSize><![CDATA[]]></prefixSize>
+                <fieldUid><![CDATA[717ACB37-EF84-48DC-94E4-2AAC066C0A33]]></fieldUid>
+            </SQLIndexEntry>
+            <SQLIndexEntry>
+                <name><![CDATA[ipv4]]></name>
+                <prefixSize><![CDATA[]]></prefixSize>
+                <fieldUid><![CDATA[F18DB7D4-F902-4863-870C-CB07032AE17C]]></fieldUid>
+            </SQLIndexEntry>
+            <indexNamePrefix><![CDATA[sip_gateways]]></indexNamePrefix>
+            <uid><![CDATA[83F405A9-2AE5-415C-9B5E-5E9B92A32F57]]></uid>
+        </SQLIndex>
+        <SQLIndex>
+            <name><![CDATA[idx_sip_gateways_inbound_netmask]]></name>
+            <fieldName><![CDATA[inbound]]></fieldName>
+            <fieldName><![CDATA[netmask]]></fieldName>
+            <SQLIndexEntry>
+                <name><![CDATA[inbound]]></name>
+                <prefixSize><![CDATA[]]></prefixSize>
+                <fieldUid><![CDATA[CDE029DC-0C7C-400C-85E9-5005C53B7460]]></fieldUid>
+            </SQLIndexEntry>
+            <SQLIndexEntry>
+                <name><![CDATA[netmask]]></name>
+                <prefixSize><![CDATA[]]></prefixSize>
+                <fieldUid><![CDATA[717ACB37-EF84-48DC-94E4-2AAC066C0A33]]></fieldUid>
+            </SQLIndexEntry>
+            <indexNamePrefix><![CDATA[sip_gateways]]></indexNamePrefix>
+            <uid><![CDATA[8322B9B7-DC3A-4B0D-85A8-2D15E4C51340]]></uid>
+        </SQLIndex>
         <labelWindowIndex><![CDATA[31]]></labelWindowIndex>
         <objectComment><![CDATA[A whitelisted sip gateway used for origination/termination]]></objectComment>
         <ui.treeExpanded><![CDATA[1]]></ui.treeExpanded>
@@ -3193,17 +3233,17 @@
         <overviewPanelHidden><![CDATA[0]]></overviewPanelHidden>
         <pageBoundariesVisible><![CDATA[0]]></pageBoundariesVisible>
         <PageGridVisible><![CDATA[0]]></PageGridVisible>
-        <RightSidebarWidth><![CDATA[1235.000000]]></RightSidebarWidth>
+        <RightSidebarWidth><![CDATA[2944.000000]]></RightSidebarWidth>
         <sidebarIndex><![CDATA[2]]></sidebarIndex>
         <snapToGrid><![CDATA[0]]></snapToGrid>
         <SourceSidebarWidth><![CDATA[0.000000]]></SourceSidebarWidth>
         <SQLEditorFileFormatVersion><![CDATA[4]]></SQLEditorFileFormatVersion>
         <uid><![CDATA[58C99A00-06C9-478C-A667-C63842E088F3]]></uid>
-        <windowHeight><![CDATA[876.000000]]></windowHeight>
-        <windowLocationX><![CDATA[-1164.000000]]></windowLocationX>
-        <windowLocationY><![CDATA[1161.000000]]></windowLocationY>
+        <windowHeight><![CDATA[965.000000]]></windowHeight>
+        <windowLocationX><![CDATA[-1886.000000]]></windowLocationX>
+        <windowLocationY><![CDATA[1072.000000]]></windowLocationY>
         <windowScrollOrigin><![CDATA[{0, 0}]]></windowScrollOrigin>
-        <windowWidth><![CDATA[1512.000000]]></windowWidth>
+        <windowWidth><![CDATA[3221.000000]]></windowWidth>
     </SQLDocumentInfo>
     <AllowsIndexRenamingOnInsert><![CDATA[1]]></AllowsIndexRenamingOnInsert>
     <defaultLabelExpanded><![CDATA[1]]></defaultLabelExpanded>

db/upgrade-jambonz-db.js

@@ -235,9 +235,10 @@ const sql = {
     'ALTER TABLE voip_carriers ADD COLUMN trunk_type ENUM(\'static_ip\',\'auth\',\'reg\') NOT NULL DEFAULT \'static_ip\'',
     'ALTER TABLE predefined_carriers ADD COLUMN trunk_type ENUM(\'static_ip\',\'auth\',\'reg\') NOT NULL DEFAULT \'static_ip\'',
     'CREATE INDEX idx_sip_gateways_inbound_carrier ON sip_gateways (inbound,voip_carrier_sid)',
-  ]
+    'CREATE INDEX idx_sip_gateways_inbound_lookup ON sip_gateways (inbound,netmask,ipv4)',
+    'CREATE INDEX idx_sip_gateways_inbound_netmask ON sip_gateways (inbound,netmask)'
+  ],
 };
-
 const doIt = async() => {
   let connection;
   try {

lib/models/application.js

@@ -54,9 +54,19 @@ class Application extends Model {
   }
 
   static countAll(obj) {
-    let sql = 'SELECT COUNT(*) AS count FROM applications app WHERE 1 = 1';
     const args = [];
-    sql += Application._criteriaBuilder(obj, args);
+    const criteriaClause = Application._criteriaBuilder(obj, args);
+
+    // Only use "WHERE 1 = 1" if there are no filters
+    // Otherwise start with the actual filter for better index usage
+    let sql;
+    if (criteriaClause) {
+      // Remove leading ' AND ' from criteriaBuilder output and use as WHERE clause
+      sql = 'SELECT COUNT(*) AS count FROM applications app WHERE ' + criteriaClause.substring(5);
+    } else {
+      // No filters provided - count all applications
+      sql = 'SELECT COUNT(*) AS count FROM applications app WHERE 1 = 1';
+    }
     return new Promise((resolve, reject) => {
       getMysqlConnection((err, conn) => {
         if (err) return reject(err);
@@ -123,9 +133,19 @@ class Application extends Model {
     }
 
     // No pagination - use original query
-    let sql = retrieveSql + ' WHERE 1 = 1';
     const args = [];
-    sql += Application._criteriaBuilder(obj, args);
+    const criteriaClause = Application._criteriaBuilder(obj, args);
+
+    // Only use "WHERE 1 = 1" if there are no filters
+    // Otherwise start with the actual filter for better index usage
+    let sql;
+    if (criteriaClause) {
+      // Remove leading ' AND ' from criteriaBuilder output and use as WHERE clause
+      sql = retrieveSql + ' WHERE ' + criteriaClause.substring(5);
+    } else {
+      // No filters provided - must list all applications
+      sql = retrieveSql + ' WHERE 1 = 1';
+    }
     sql += ' ORDER BY app.application_sid';
 
     return new Promise((resolve, reject) => {

lib/routes/api/accounts.js

@@ -140,6 +140,11 @@ router.put('/:sid/VoipCarriers/:voip_carrier_sid', async(req, res) => {
   const logger = req.app.locals.logger;
 
   try {
+    if (process.env.JAMBONES_ADMIN_CARRIER == 1 && (!req.user.hasScope('service_provider')
+      && !req.user.hasScope('admin'))) {
+      throw new DbErrorBadRequest('insufficient privileges');
+    }
+
     const sid = parseVoipCarrierSid(req);
     const account_sid = parseAccountSid(req);
     await validateRequest(req, account_sid);
@@ -159,6 +164,10 @@ router.post('/:sid/VoipCarriers', async(req, res) => {
   const logger = req.app.locals.logger;
   const payload = req.body;
   try {
+    if (process.env.JAMBONES_ADMIN_CARRIER == 1 && (!req.user.hasScope('service_provider')
+      || !!req.user.hasScope('admin'))) {
+      throw new DbErrorBadRequest('insufficient privileges');
+    }
     const account_sid = parseAccountSid(req);
     await validateRequest(req, account_sid);
     // Set the service_provder_sid to the relevent value for the account
@@ -299,7 +308,8 @@ function validateUpdateCall(opts) {
     'dtmf',
     'conferenceParticipantAction',
     'dub',
-    'boostAudioSignal'
+    'boostAudioSignal',
+    'media_path'
   ]
     .reduce((acc, prop) => (opts[prop] ? ++acc : acc), 0);
 
@@ -363,6 +373,9 @@ function validateUpdateCall(opts) {
       throw new DbErrorBadRequest('conferenceParticipantAction requires tag property when action is \'coach\'');
     }
   }
+  if (opts.media_path && !['no-media', 'partial-media', 'full-media'].includes(opts.media_path)) {
+    throw new DbErrorBadRequest('invalid media_path');
+  }
 }
 
 function validateTo(to) {

lib/routes/api/applications.js

@@ -101,6 +101,20 @@ async function validateUpdate(req, sid) {
   if (req.body.call_status_hook && typeof req.body.call_hook !== 'object') {
     throw new DbErrorBadRequest('\'call_status_hook\' must be an object when updating an application');
   }
+
+  let urlError;
+  if (req.body.call_hook) {
+    urlError = await isInvalidUrl(req.body.call_hook.url);
+    if (urlError) {
+      throw new DbErrorBadRequest(`call_hook ${urlError}`);
+    }
+  }
+  if (req.body.call_status_hook) {
+    urlError = await isInvalidUrl(req.body.call_status_hook.url);
+    if (urlError) {
+      throw new DbErrorBadRequest(`call_status_hook ${urlError}`);
+    }
+  }
 }
 
 async function validateDelete(req, sid) {
@@ -290,9 +304,6 @@ router.put('/:sid', async(req, res) => {
           obj[`${prop}_sid`] = sid;
         }
       }
-      else {
-        obj[`${prop}_sid`] = null;
-      }
       delete obj[prop];
     }
 

lib/routes/api/phone-numbers.js

@@ -19,6 +19,11 @@ const hasWhitespace = (str) => /\s/.test(str);
 /* check for required fields when adding */
 async function validateAdd(req) {
   try {
+    if (process.env.JAMBONES_ADMIN_CARRIER == 1 && (!req.user.hasScope('service_provider')
+      && !req.user.hasScope('admin'))) {
+      throw new DbErrorBadRequest('insufficient privileges');
+    }
+
     /* account level user can only act on carriers associated to his/her account */
     if (req.user.hasAccountAuth) {
       req.body.account_sid = req.user.account_sid;

lib/routes/api/sip-gateways.js

@@ -45,6 +45,12 @@ const validate = async(req, sid) => {
   const {netmask, ipv4, inbound, outbound} = req.body;
   let voip_carrier_sid;
 
+  if (process.env.JAMBONES_ADMIN_CARRIER == 1 && (!req.user.hasScope('service_provider')
+    && !req.user.hasScope('admin'))) {
+    throw new DbErrorBadRequest('insufficient privileges');
+  }
+
+
   if (sid) {
     const gateway = await lookupSipGatewayBySid(sid);
     if (!gateway) throw new DbErrorBadRequest('invalid sip_gateway_sid');

lib/routes/api/speech-credentials.js

@@ -173,14 +173,23 @@ const encryptCredential = (obj) => {
   switch (vendor) {
     case 'google':
       assert(service_key, 'invalid json key: service_key is required');
+      let modified_service_key = service_key;
       try {
         const o = JSON.parse(service_key);
+        // support google gemini tts
+        if (model_id) {
+          o.model_id = model_id;
+        } else {
+          delete o.model_id;
+        }
+
         assert(o.client_email && o.private_key, 'invalid google service account key');
+        modified_service_key = JSON.stringify(o);
       }
       catch (err) {
         assert(false, 'invalid google service account key - not JSON');
       }
-      return encrypt(service_key);
+      return encrypt(modified_service_key);
 
     case 'aws':
       // AWS polly can work for 3 types of credentials:
@@ -582,7 +591,7 @@ router.put('/:sid', async(req, res) => {
           custom_tts_url,
           custom_tts_streaming_url,
           cobalt_server_uri,
-          model_id,
+          model_id: model_id !== undefined ? model_id : o.model_id,
           stt_model_id,
           voice_engine,
           options,
@@ -596,7 +605,8 @@ router.put('/:sid', async(req, res) => {
           resemble_tts_uri,
           resemble_tts_use_tls,
           api_uri,
-          houndify_server_uri
+          houndify_server_uri,
+          ...(vendor === 'google' && {service_key: JSON.stringify(o)})
         };
         logger.info({o, newCred}, 'updating speech credential with this new credential');
         obj.credential = encryptCredential(newCred);

lib/routes/api/subscriptions.js

@@ -151,9 +151,7 @@ const upgradeToPaidPlan = async(req, res) => {
 };
 
 const validateProductQuantities = async(products) => {
-  // validate voice call session minimums
-  const productModel = new Product();
-  const availableProducts = await productModel.retrieveAll();
+  const availableProducts = await Product.retrieveAll();
   const voiceCallSessionsProductSid =
     availableProducts.find((p) => p.category === 'voice_call_session')?.product_sid;
   if (voiceCallSessionsProductSid) {

lib/routes/api/voip-carriers.js

@@ -9,6 +9,11 @@ const { parseVoipCarrierSid } = require('./utils');
 const validate = async(req) => {
   const {lookupAppBySid, lookupAccountBySid} = req.app.locals;
 
+  if (process.env.JAMBONES_ADMIN_CARRIER == 1 && (!req.user.hasScope('service_provider')
+    && !req.user.hasScope('admin'))) {
+    throw new DbErrorBadRequest('insufficient privileges');
+  }
+
   /* account level user can only act on carriers associated to his/her account */
   if (req.user.hasAccountAuth) {
     req.body.account_sid = req.user.account_sid;
@@ -45,6 +50,12 @@ const validateUpdate = async(req, sid) => {
 
 const validateDelete = async(req, sid) => {
   const {lookupCarrierBySid} = req.app.locals;
+  if (process.env.JAMBONES_ADMIN_CARRIER == 1 && (!req.user.hasScope('service_provider')
+    && !req.user.hasScope('admin'))) {
+    throw new DbErrorBadRequest('insufficient privileges');
+  }
+
+
   if (req.user.hasAccountAuth) {
     /* can only update carriers for the user's account */
     const carrier = await lookupCarrierBySid(sid);

lib/routes/stripe/webhook.js

@@ -13,6 +13,10 @@ const handleInvoicePaymentSucceeded = async(logger, obj) => {
   const sub = await retrieveSubscription(logger, subscription);
   if ('active' === sub.status) {
     const {account_sid} = sub.metadata;
+    if (!account_sid) {
+      logger.info({subscription}, `handleInvoicePaymentSucceeded: received subscription ${sub.id} without account_sid`);
+      return;
+    }
     if (await Account.activateSubscription(logger, account_sid, sub.id,
       'subscription_create' === obj.billing_reason ? 'upgrade to paid plan' : 'change plan details')) {
       logger.info(`handleInvoicePaymentSucceeded: activated subscription for account ${account_sid}`);
@@ -35,6 +39,10 @@ const handleInvoicePaymentFailed = async(logger, obj) => {
   const sub = await retrieveSubscription(logger, subscription);
   logger.debug({obj}, `payment for ${obj.billing_reason} failed, subscription status is ${sub.status}`);
   const {account_sid} = sub.metadata;
+  if (!account_sid) {
+    logger.info({subscription}, `handleInvoicePaymentFailed: received subscription ${sub.id} without account_sid`);
+    return;
+  }
   if (await Account.deactivateSubscription(logger, account_sid, 'payment failed')) {
     logger.info(`handleInvoicePaymentFailed: deactivated subscription for account ${account_sid}`);
   }

lib/utils/speech-data/stt-openai.js

@@ -1,4 +1,5 @@
 module.exports = [
+  { name: 'Auto Language', value: 'auto'},
   { name: 'Afrikaans', value: 'af' },
   { name: 'Arabic', value: 'ar' },
   { name: 'Azerbaijani', value: 'az' },

lib/utils/speech-utils.js

@@ -70,7 +70,9 @@ const testSonioxStt = async(logger, credentials) => {
 
   return new Promise(async(resolve, reject) => {
     try {
-      const result = await soniox.transcribeFileShort('data/test_audio.wav');
+      const result = await soniox.transcribeFileShort('data/test_audio.wav', {
+        model: 'en_v2'
+      });
       if (result.words.length > 0) resolve(result);
       else reject(new Error('no transcript returned'));
     } catch (error) {
@@ -779,6 +781,7 @@ function decryptCredential(obj, credential, logger, isObscureKey = true) {
         o.private_key.slice(key_header.length, o.private_key.length)}`
     };
     obj.service_key = JSON.stringify(obscured);
+    obj.model_id = o.model_id || null;
   }
   else if ('aws' === obj.vendor) {
     const o = JSON.parse(decrypt(credential));
@@ -1524,11 +1527,11 @@ function parseGooglelanguagesVoices(data) {
   return data.reduce((acc, voice) => {
     const languageCode = voice.languageCodes[0];
     const existingLanguage = acc.find((lang) => lang.value === languageCode);
-
     if (existingLanguage) {
       existingLanguage.voices.push({
         value: voice.name,
-        name: `${voice.name.substring(languageCode.length + 1, voice.name.length)} (${voice.ssmlGender})`
+        name: `${voice.name.startsWith(languageCode) ?
+          voice.name.substring(languageCode.length + 1, voice.name.length) : voice.name} (${voice.ssmlGender})`
       });
     } else {
       acc.push({
@@ -1536,7 +1539,8 @@ function parseGooglelanguagesVoices(data) {
         name: SttGoogleLanguagesVoices.find((lang) => lang.value === languageCode)?.name || languageCode,
         voices: [{
           value: voice.name,
-          name: `${voice.name.substring(languageCode.length + 1, voice.name.length)} (${voice.ssmlGender})`
+          name: `${voice.name.startsWith(languageCode) ?
+            voice.name.substring(languageCode.length + 1, voice.name.length) : voice.name} (${voice.ssmlGender})`
         }]
       });
     }

package.json

@@ -32,7 +32,7 @@
     "@jambonz/lamejs": "^1.2.2",
     "@jambonz/mw-registrar": "^0.2.7",
     "@jambonz/realtimedb-helpers": "^0.8.15",
-    "@jambonz/speech-utils": "^0.2.26",
+    "@jambonz/speech-utils": "^0.2.30",
     "@jambonz/time-series": "^0.2.8",
     "@jambonz/verb-specifications": "^0.0.122",
     "@soniox/soniox-node": "^1.2.2",

test/applications.js

@@ -285,3 +285,177 @@ test('application tests', async(t) => {
   }
 });
 
+test('application query optimization tests', async(t) => {
+  const app = require('../app');
+  try {
+    let result;
+
+    /* Create multiple service providers and accounts to test filtering */
+    const voip_carrier_sid = await createVoipCarrier(request, 'test-carrier-apps');
+
+    const service_provider_sid_1 = await createServiceProvider(request, 'test-sp-1');
+    const service_provider_sid_2 = await createServiceProvider(request, 'test-sp-2');
+
+    const account_sid_1 = await createAccount(request, service_provider_sid_1, 'test-account-1');
+    const account_sid_2 = await createAccount(request, service_provider_sid_2, 'test-account-2');
+
+    /* Create applications for different accounts */
+    const app1_result = await request.post('/Applications', {
+      auth: authAdmin,
+      json: true,
+      body: {
+        name: 'test-app-account-1',
+        account_sid: account_sid_1,
+        call_hook: { url: 'http://example.com/app1' },
+        call_status_hook: { url: 'http://example.com/app1/status' }
+      }
+    });
+    const app1_sid = app1_result.sid;
+
+    const app2_result = await request.post('/Applications', {
+      auth: authAdmin,
+      json: true,
+      body: {
+        name: 'test-app-account-2',
+        account_sid: account_sid_2,
+        call_hook: { url: 'http://example.com/app2' },
+        call_status_hook: { url: 'http://example.com/app2/status' }
+      }
+    });
+    const app2_sid = app2_result.sid;
+
+    const app3_result = await request.post('/Applications', {
+      auth: authAdmin,
+      json: true,
+      body: {
+        name: 'another-app-account-1',
+        account_sid: account_sid_1,
+        call_hook: { url: 'http://example.com/app3' },
+        call_status_hook: { url: 'http://example.com/app3/status' }
+      }
+    });
+    const app3_sid = app3_result.sid;
+
+    /* Test 1: Query all applications as admin (no filter) - tests WHERE 1=1 fallback */
+    result = await request.get('/Applications', {
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.length >= 3, 'admin can see all applications using WHERE 1=1');
+    const ourApps = result.filter(app =>
+      [app1_sid, app2_sid, app3_sid].includes(app.application_sid)
+    );
+    t.ok(ourApps.length === 3, 'all three test applications are included in results');
+
+    /* Test 2: Query applications with name filter (LIKE query) - tests WHERE name LIKE optimization */
+    result = await request.get('/Applications', {
+      qs: { name: 'test-app' },
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.length === 2, 'successfully filtered applications by name prefix');
+    t.ok(result.every(app => app.name.includes('test-app')), 'all results match name filter');
+
+    /* Test 3: Query applications with exact name match - tests WHERE optimization */
+    result = await request.get('/Applications', {
+      qs: { name: 'test-app-account-1' },
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.length === 1, 'successfully filtered applications by exact name');
+    t.ok(result[0].name === 'test-app-account-1', 'exact name match works correctly');
+
+    /* Test 4: Query with name filter that matches nothing */
+    result = await request.get('/Applications', {
+      qs: { name: 'nonexistent-app-12345' },
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.length === 0, 'non-matching name filter returns empty array');
+
+    /* Test 5: Query with pagination and name filter - tests countAll optimization */
+    result = await request.get('/Applications', {
+      qs: {
+        name: 'test-app',
+        page: 1,
+        page_size: 10
+      },
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.data.length === 2, 'pagination with name filter returns correct count');
+    t.ok(result.total === 2, 'countAll with name filter returns correct total');
+    t.ok(result.page === 1, 'pagination returns correct page number');
+    t.ok(result.page_size === 10, 'pagination returns correct page size');
+
+    /* Test 6: Query with pagination and no filter - tests WHERE 1=1 fallback */
+    result = await request.get('/Applications', {
+      qs: {
+        page: 1,
+        page_size: 2
+      },
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.data.length === 2, 'pagination without filter returns page_size results');
+    t.ok(result.total >= 3, 'pagination without filter uses WHERE 1=1 and returns all');
+
+    /* Test 7: Create SP-scoped token and verify WHERE service_provider_sid optimization */
+    const sp1_token_result = await request.post('/ApiKeys', {
+      auth: authAdmin,
+      json: true,
+      body: {
+        service_provider_sid: service_provider_sid_1
+      }
+    });
+    const sp1_token = sp1_token_result.token;
+    const sp1_token_sid = sp1_token_result.sid;
+
+    result = await request.get('/Applications', {
+      auth: {bearer: sp1_token},
+      json: true,
+    });
+    t.ok(result.length === 2, 'SP-scoped token sees only their applications via WHERE service_provider_sid');
+    t.ok(result.every(app => app.account_sid === account_sid_1), 'all apps belong to SP1 accounts');
+
+    /* Test 8: SP-scoped token with name filter - tests combined WHERE clause */
+    result = await request.get('/Applications', {
+      qs: { name: 'test-app' },
+      auth: {bearer: sp1_token},
+      json: true,
+    });
+    t.ok(result.length === 1, 'SP-scoped token with name filter combines filters correctly');
+    t.ok(result[0].name === 'test-app-account-1', 'combined filter returns correct app');
+
+    /* Test 9: SP-scoped token with pagination - tests countAll with service_provider_sid */
+    result = await request.get('/Applications', {
+      qs: {
+        page: 1,
+        page_size: 10
+      },
+      auth: {bearer: sp1_token},
+      json: true,
+    });
+    t.ok(result.data.length === 2, 'SP-scoped pagination returns correct count');
+    t.ok(result.total === 2, 'countAll with service_provider_sid returns correct total');
+
+    /* Cleanup tokens */
+    await deleteObjectBySid(request, '/ApiKeys', sp1_token_sid);
+
+    /* Cleanup */
+    await deleteObjectBySid(request, '/Applications', app1_sid);
+    await deleteObjectBySid(request, '/Applications', app2_sid);
+    await deleteObjectBySid(request, '/Applications', app3_sid);
+    await deleteObjectBySid(request, '/Accounts', account_sid_1);
+    await deleteObjectBySid(request, '/Accounts', account_sid_2);
+    await deleteObjectBySid(request, '/VoipCarriers', voip_carrier_sid);
+    await deleteObjectBySid(request, '/ServiceProviders', service_provider_sid_1);
+    await deleteObjectBySid(request, '/ServiceProviders', service_provider_sid_2);
+
+    //t.end();
+  }
+  catch (err) {
+    t.end(err);
+  }
+});
+

test/speech-credentials.js

@@ -1136,6 +1136,115 @@ test('speech credentials tests', async(t) => {
     });
     t.ok(result.body.stt.length !== 0, 'successfully get gladia supported languages and voices');
 
+    /* add a credential for google with model_id */
+    result = await request.post(`/Accounts/${account_sid}/SpeechCredentials`, {
+      resolveWithFullResponse: true,
+      auth: authUser,
+      json: true,
+      body: {
+        vendor: 'google',
+        label: 'google_gemini_tts',
+        service_key: jsonKey,
+        use_for_tts: true,
+        use_for_stt: true,
+        model_id: 'gemini-2.0-flash-exp'
+      }
+    });
+    t.ok(result.statusCode === 201, 'successfully added speech credential for google with model_id');
+    const google_gemini_sid = result.body.sid;
+
+    /* query the credential and verify model_id are stored */
+    result = await request.get(`/Accounts/${account_sid}/SpeechCredentials/${google_gemini_sid}`, {
+      resolveWithFullResponse: true,
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.statusCode === 200, 'successfully retrieved google gemini speech credential');
+    t.ok(result.body.vendor === 'google', 'vendor is google');
+    t.ok(result.body.label === 'google_gemini_tts', 'label is correct');
+    t.ok(result.body.model_id === 'gemini-2.0-flash-exp', 'model_id is correct');
+
+    /* update the credential to change model_id */
+    result = await request.put(`/Accounts/${account_sid}/SpeechCredentials/${google_gemini_sid}`, {
+      resolveWithFullResponse: true,
+      auth: authUser,
+      json: true,
+      body: {
+        use_for_tts: true,
+        use_for_stt: true,
+        model_id: 'gemini-2.5-flash-preview-native-audio'
+      }
+    });
+    t.ok(result.statusCode === 204, 'successfully updated google gemini speech credential');
+
+    /* verify the update */
+    result = await request.get(`/Accounts/${account_sid}/SpeechCredentials/${google_gemini_sid}`, {
+      resolveWithFullResponse: true,
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.statusCode === 200, 'successfully retrieved updated google gemini speech credential');
+    t.ok(result.body.model_id === 'gemini-2.5-flash-preview-native-audio', 'model_id is updated correctly');
+
+    /* update the credential to disable gemini tts */
+    result = await request.put(`/Accounts/${account_sid}/SpeechCredentials/${google_gemini_sid}`, {
+      resolveWithFullResponse: true,
+      auth: authUser,
+      json: true,
+      body: {
+        use_for_tts: true,
+        use_for_stt: true,
+        model_id: null
+      }
+    });
+    t.ok(result.statusCode === 204, 'successfully updated google speech credential to disable gemini tts');
+
+    /* verify the update to disable gemini tts */
+    result = await request.get(`/Accounts/${account_sid}/SpeechCredentials/${google_gemini_sid}`, {
+      resolveWithFullResponse: true,
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.statusCode === 200, 'successfully retrieved google speech credential after disabling gemini');
+    t.ok(!result.body.model_id, 'model_id is now null');
+
+    /* delete the google gemini credential */
+    result = await request.delete(`/Accounts/${account_sid}/SpeechCredentials/${google_gemini_sid}`, {
+      auth: authUser,
+      resolveWithFullResponse: true,
+    });
+    t.ok(result.statusCode === 204, 'successfully deleted google gemini speech credential');
+
+    /* add a credential for google at service provider level with gemini tts */
+    result = await request.post(`/ServiceProviders/${service_provider_sid}/SpeechCredentials`, {
+      resolveWithFullResponse: true,
+      auth: authAdmin,
+      json: true,
+      body: {
+        vendor: 'google',
+        service_key: jsonKey,
+        use_for_tts: true,
+        use_for_stt: true,
+        model_id: 'gemini-2.0-flash-exp'
+      }
+    });
+    t.ok(result.statusCode === 201, 'successfully added google gemini speech credential to service provider');
+    const sp_google_gemini_sid = result.body.sid;
+
+    /* query the service provider credential */
+    result = await request.get(`/ServiceProviders/${service_provider_sid}/SpeechCredentials`, {
+      resolveWithFullResponse: true,
+      auth: authAdmin,
+      json: true,
+    });
+    t.ok(result.statusCode === 200, 'successfully queried service provider speech credentials');
+    const spCred = result.body.find(c => c.speech_credential_sid === sp_google_gemini_sid);
+    t.ok(spCred, 'found google gemini credential in service provider credentials');
+    t.ok(spCred.model_id === 'gemini-2.0-flash-exp', 'model_id is correct for SP credential');
+
+    /* delete the service provider google gemini credential */
+    await deleteObjectBySid(request, `/ServiceProviders/${service_provider_sid}/SpeechCredentials`, sp_google_gemini_sid);
+
     await deleteObjectBySid(request, '/Accounts', account_sid);
     await deleteObjectBySid(request, '/ServiceProviders', service_provider_sid);
     t.end();