if else made authorization check unreachable (#90)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3368756
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3368756
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-5291792
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-5291792

Co-authored-by: snyk-bot <snyk-bot@snyk.io>

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 node:18.14.1-alpine3.16 as base
+FROM --platform=linux/amd64 node:18.15-alpine3.16 as base
 
 RUN apk --update --no-cache add --virtual .builds-deps build-base python3
 

app.js

@@ -247,7 +247,8 @@ if (process.env.K8S || process.env.HTTP_PORT) {
 if ('test' !== process.env.NODE_ENV) {
   /* update call stats periodically */
   setInterval(() => {
-    stats.gauge('sbc.sip.calls.count', activeCallIds.size, ['direction:inbound']);
+    stats.gauge('sbc.sip.calls.count', activeCallIds.size,
+      ['direction:inbound', `instance_id:${process.env.INSTANCE_ID || 0}`]);
   }, 20000);
 }
 

lib/call-session.js

@@ -223,7 +223,7 @@ class CallSession extends Emitter {
       if (this.req.locals.application_sid) {
         Object.assign(headers, {'X-Application-Sid': this.req.locals.application_sid});
       }
-      else if (this.req.authorization) {
+      if (this.req.authorization) {
         if (this.req.authorization.grant && this.req.authorization.grant.application_sid) {
           Object.assign(headers, {'X-Application-Sid': this.req.authorization.grant.application_sid});
         }
@@ -293,7 +293,6 @@ class CallSession extends Emitter {
     } catch (err) {
       this.rtpEngineResource.destroy().catch((err) => this.logger.info({err}, 'Error destroying rtpe after failure'));
       this.activeCallIds.delete(this.req.get('Call-ID'));
-      this.stats.gauge('sbc.sip.calls.count', this.activeCallIds.size);
       if (err instanceof SipError) {
         const tags = ['accepted:no', `sipStatus:${err.status}`, `originator:${this.req.locals.originator}`];
         this.stats.increment('sbc.terminations', tags);

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbc-inbound",
-  "version": "v0.8.1",
+  "version": "v0.8.2",
   "main": "app.js",
   "engines": {
     "node": ">= 12.0.0"
@@ -28,10 +28,10 @@
     "@jambonz/db-helpers": "^0.7.4",
     "@jambonz/http-authenticator": "^0.2.2",
     "@jambonz/http-health-check": "^0.0.1",
-    "@jambonz/realtimedb-helpers": "^0.6.3",
+    "@jambonz/realtimedb-helpers": "^0.7.0",
     "@jambonz/rtpengine-utils": "^0.4.3",
     "@jambonz/siprec-client-utils": "^0.2.4",
-    "@jambonz/stats-collector": "^0.1.6",
+    "@jambonz/stats-collector": "^0.1.8",
     "@jambonz/time-series": "^0.2.5",
     "aws-sdk": "^2.1261.0",
     "bent": "^7.3.12",