From f0999b767719fda8335dcd84ee7e438878ccec4e Mon Sep 17 00:00:00 2001
From: Genseric <58644045+genseric-ghiro@users.noreply.github.com>
Date: Tue, 10 Nov 2026 17:00:07 -0500
Subject: [PATCH] TEL-1228: reject sip_source_call_id in CreateSIPParticipant
 (#5172)

* TEL-1228: reject sip_source_call_id in CreateSIPParticipant

* Addressing comment

* Bump protocol
---
 go.mod                  |  2 +-
 go.sum                  |  4 ++--
 pkg/service/sip.go      |  6 ++++++
 pkg/service/sip_test.go | 19 +++++++++++++++++++
 4 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index d31cfe9ec..4411b8e50 100644
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/jxskiss/base62 v1.1.0
 	github.com/livekit/mageutil v0.0.0-20250511045019-0f1ff63f7731
 	github.com/livekit/mediatransportutil v0.0.0-20261105133908-2cf1b1487796
-	github.com/livekit/protocol v1.53.3-0.20261110074248-a24ade1483e9
+	github.com/livekit/protocol v1.53.3-0.20261110212946-e6dd7c1a6bf6
 	github.com/livekit/psrpc v0.8.2
 	github.com/mackerelio/go-osstat v0.2.8
 	github.com/magefile/mage v1.17.2
diff --git a/go.sum b/go.sum
index ef7a3388a..7c46b82a7 100644
--- a/go.sum
+++ b/go.sum
@@ -164,8 +164,8 @@ github.com/livekit/mageutil v0.0.0-20250511045019-0f1ff63f7731 h1:9x+U2HGLrSw5AT
 github.com/livekit/mageutil v0.0.0-20250511045019-0f1ff63f7731/go.mod h1:Rs3MhFwutWhGwmY1VQsygw28z5bWcnEYmS1OG9OxjOQ=
 github.com/livekit/mediatransportutil v0.0.0-20261105133908-2cf1b1487796 h1:Ywn57x0LFvbUbHFV1gESlPA/4u8FHIpuEJIwQH3CQZA=
 github.com/livekit/mediatransportutil v0.0.0-20261105133908-2cf1b1487796/go.mod h1:/T+BvdqiQN7mYJJk5EFFqbdbe7yBAvR8Ilx5kMVzT4M=
-github.com/livekit/protocol v1.53.3-0.20261110074248-a24ade1483e9 h1:TSaW9DM7gE/VqUr7aHAdsURVDEzylKK0hyBBrN3St8c=
-github.com/livekit/protocol v1.53.3-0.20261110074248-a24ade1483e9/go.mod h1:S0AnW03n6zgnWZOq+T4L1PtT9POxTBgrgEH1jyR6fl4=
+github.com/livekit/protocol v1.53.3-0.20261110212946-e6dd7c1a6bf6 h1:+OXv8KmqHXfO2Jdyf0iiVUtsW0R80kucNBzlY/UdSM8=
+github.com/livekit/protocol v1.53.3-0.20261110212946-e6dd7c1a6bf6/go.mod h1:S0AnW03n6zgnWZOq+T4L1PtT9POxTBgrgEH1jyR6fl4=
 github.com/livekit/psrpc v0.8.2 h1:7tbkhBJoYlK5Csfkdv1XYbZjyAQeaEZgupvIXNCv7Dc=
 github.com/livekit/psrpc v0.8.2/go.mod h1:6KnU8vULoizX0Er9NNfeKJDV8ug87j3fuo19M0bhj6Q=
 github.com/livekit/webrtc-pion/v4 v4.2.25-warp.3 h1:n6Rctm2NI+YuAZlAuI0yDw+ZmazAIcol6sjeeTqU32I=
diff --git a/pkg/service/sip.go b/pkg/service/sip.go
index 12969c0e7..09da2226c 100644
--- a/pkg/service/sip.go
+++ b/pkg/service/sip.go
@@ -646,6 +646,12 @@ func (s *SIPService) DeleteSIPDispatchRule(ctx context.Context, req *livekit.Del
 }
 
 func (s *SIPService) CreateSIPParticipant(ctx context.Context, req *livekit.CreateSIPParticipantRequest) (*livekit.SIPParticipantInfo, error) {
+	if err := EnsureSIPCallPermission(ctx); err != nil {
+		return nil, twirpAuthError(err)
+	}
+	if req.SipSourceCallId != "" {
+		return nil, psrpc.NewErrorf(psrpc.Unimplemented, "sip_source_call_id is not supported")
+	}
 	unlikelyLogger := logger.GetLogger().WithUnlikelyValues(
 		"room", req.RoomName,
 		"sipTrunk", req.SipTrunkId,
diff --git a/pkg/service/sip_test.go b/pkg/service/sip_test.go
index d59613629..28bed722c 100644
--- a/pkg/service/sip_test.go
+++ b/pkg/service/sip_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/livekit/protocol/livekit"
 	"github.com/livekit/protocol/utils"
 	"github.com/livekit/protocol/utils/guid"
+	"github.com/livekit/psrpc"
 	"github.com/stretchr/testify/require"
 	"github.com/twitchtv/twirp"
 	"google.golang.org/protobuf/proto"
@@ -184,3 +185,21 @@ func TestSIPInboundTrunkRejectsURINumbers(t *testing.T) {
 		requireInvalidArgument(t, err)
 	})
 }
+
+func TestCreateSIPParticipantSourceCallUnsupported(t *testing.T) {
+	req := &livekit.CreateSIPParticipantRequest{SipSourceCallId: "SCL_1"}
+
+	t.Run("without SIP call permission", func(t *testing.T) {
+		_, err := (&service.SIPService{}).CreateSIPParticipant(context.Background(), req)
+		var terr twirp.Error
+		require.ErrorAs(t, err, &terr)
+		require.Equal(t, twirp.Unauthenticated, terr.Code())
+	})
+
+	t.Run("with SIP call permission", func(t *testing.T) {
+		ctx := service.WithGrants(context.Background(), &auth.ClaimGrants{SIP: &auth.SIPGrant{Call: true}}, "")
+		_, err := (&service.SIPService{}).CreateSIPParticipant(ctx, req)
+		code, _ := psrpc.GetErrorCode(err)
+		require.Equal(t, psrpc.Unimplemented, code)
+	})
+}