fix(calling): remediate P0 security vulnerabilities in CallingClient, registration, Contacts, and Voicemail

[mkesavan13]

COMPLETES https://jira.cisco.com/browse/CAI-8462

This pull request addresses

Four P0 security vulnerabilities in packages/calling/src identified in CAI-8462:

• BroadworksBackendConnector (AC-1): BroadWorks bwtoken JWTs were not validated before their sub claim was used as a userId, allowing attacker-controlled values to propagate.
• register.ts (AC-2): Keepalive-failure state transitions lacked mutex protection, creating a race condition where setStatus(INACTIVE), timer clears, lineEmitter transitions, and failoverImmediately could execute concurrently.
• ContactsClient (AC-3): Contact encrypt/decrypt operations accepted server-supplied encryptionKeyUrl values without scheme validation, enabling potential KMS redirect to attacker-controlled endpoints.
• CallingClient (AC-4): Mobius server discovery accepted cluster-supplied hosts without domain validation, enabling bearer-authed requests to be sent to untrusted hosts.

by making the following changes

• BroadworksBackendConnector.ts: Added validateBwToken() — parses JWT structure, validates required claims (sub, iat), checks expiry; invalid/expired tokens route to the existing UNAUTHORIZED (401) path.
• register.ts: Wrapped keepalive-failure state transitions (setStatus(INACTIVE), clear timers, lineEmitter, failoverImmediately) in this.mutex.runExclusive; reconnectOnFailure/handle404KeepaliveFailure remain outside the lock to avoid nested-runExclusive deadlock.
• ContactsClient.ts: Added isValidEncryptionKeyUrl() — validates encryptionKeyUrl against a kms:// scheme allowlist; untrusted URLs are rejected with a logged error before any webex.internal.encryption KMS call.
• CallingClient.ts: Added isTrustedMobiusHost() — validates each cluster-supplied host against .infra.webex.com trusted domain(s); untrusted hosts are skipped with a logged error in both the discovery loop and the useDefault fallback.

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

• BroadworksBackendConnector.test.ts — new JWT validation tests: valid token returns sub; tampered/expired/missing-claim token returns 401
• register.test.ts — new mutex serialization tests: keepalive-failure transitions serialized; reconnect outside lock avoids deadlock
• ContactsClient.test.ts — new kms:// allowlist tests: trusted URL encrypts/decrypts; untrusted URL is skipped/logged
• CallingClient.test.ts — new Mobius host validation tests: trusted .infra.webex.com host proceeds; untrusted host skipped in discovery loop and fallback
• Gate 1 (compile): passed
• Gate 2 (unit tests): passed — 859 tests, 31 suites, all passing

Testing

• Tests added: 4 new test suites with security-focused test cases
• Gate 1 verification: passed — TypeScript compilation succeeded with no errors
• Gate 2 verification: passed — 859 tests across 31 suites, all passing
• Gate 3 verification: not run
• Coverage outcome: passed

Acceptance Criteria

ID	Criterion	Source	JiraToPr status	Evidence
AC-1	BroadWorks bwtoken JWT validated before sub used as userId; invalid/expired tokens return 401	CAI-8462 security finding	Unit validated	JWT validation tests passed in Gate 2
AC-2	Keepalive-failure state transitions serialized under mutex; reconnect invoked outside lock	CAI-8462 security finding	Unit validated	Mutex serialization tests passed in Gate 2
AC-3	encryptionKeyUrl validated against kms:// scheme allowlist before KMS call; untrusted URLs rejected	CAI-8462 security finding	Unit validated	Allowlist validation tests passed in Gate 2
AC-4	Mobius host validated against .infra.webex.com domain before bearer-authed request; untrusted hosts skipped	CAI-8462 security finding	Unit validated	Host validation tests passed in Gate 2

Contract Discovery Warnings

• Manifest reference discovery capped at 100 strings

The GAI Coding Policy And Copyright Annotation Best Practices

• GAI was not used (or, no additional notation is required)
• Code was generated entirely by GAI
• GAI was used to create a draft that was subsequently customized or modified
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• Tool used for AI assistance (GitHub Copilot / Other - specify)
  • Github Copilot
  • Other - Claude Code (Anthropic)
• This PR is related to
  • Feature
  • Defect fix
  • Tech Debt
  • Automation

I certified that

• I have read and followed contributing guidelines
• I discussed changes with code owners prior to submitting this pull request
• I have not skipped any automated checks
• All existing and new tests passed
• I have updated the documentation accordingly

---

Jira: https://jira.cisco.com/browse/CAI-8462

🤖 Generated with Claude Code

[gitguardian]

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
36356287	Triggered	Generic High Entropy Secret	6d21dd0	packages/calling/src/Voicemail/BroadworksBackendConnector.test.ts	View secret
36356287	Triggered	Generic High Entropy Secret	6d21dd0	packages/calling/src/Voicemail/BroadworksBackendConnector.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[aws-amplify-us-east-2]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-5177.d3m3l2kee0btzx.amplifyapp.com