fix(cdr,asterisk): resume MixMonitor after failed attended transfer

Two regressions made the call recording stop at the moment of an
attended-transfer attempt and never resume, even when the original
A↔B bridge survives — losing ~50% of the conversation audio.

Lua dialplan: skip_special_exten() guard was added around
transfer_dial_hangup in ec17302 ("fix(upload,cdr,security): chunk
size, CEL guard, rate limit whitelist"). That guard short-circuits
EXTEN='h', which is exactly the path Asterisk uses for the hangup
handler — so event_transfer_dial_hangup() never fired, and the AMI
UserEvent never reached WorkerCallEvents. Removed the guard
(hangup_chan and hangup_chan_meetme already correctly run guard-free).

PHP recovery action: ActionTransferDialHangup::fillNotAnsweredCdr was
silently broken in c0a5527 ("Translate comments into English rewrite
phpdoc blocks #522") — that commit replaced OR with AND in the CDR
filter and substituted agi_channel for the empty dst_chan, so the
transfer-attempt row was never closed; it also added an int-vs-string
comparison count() !== '1' that always returned early. Filter now
matches on transfer="1" AND src_chan=TRANSFERERNAME, and the count
check is count() !== 1. The success path (fillLocalChannelCdr) is
untouched.

CheckSSHConfig: /etc/shadow integrity check now skips when
SSHDisablePasswordLogins=true. PAM bookkeeping (lastchg, passwd -l,
etc.) mutates shadow even when password-based SSH login is disabled,
producing spurious "SSH password changed externally" alerts.

tests/Calls infrastructure also gets several fixes used to surface
and reproduce the bug:

  * start.sh::cleanup() no longer runs 'monit stop all' (that locks
    out the host via dropbear). It stops only asterisk + php-fpm,
    waits for DB handles to release, removes stale -wal/-shm before
    restoring the production DB, then brings services back. Without
    the -wal/-shm cleanup the cp leaves the DB in "malformed" state.
  * TestCallsBase::getOffPeers() excludes peers with forwarding
    configured (test 09 was getting ANSWERED CDR via mobile redirect
    instead of the expected NO_ANSWER) and sorts results for
    determinism.
  * Test 09 sample CDR updated for Asterisk 22 behaviour: 2 CDR rows
    (not 4), and the transfer-attempt duration is ~6s (PJSIP retry
    window on an unreachable endpoint), not 1s.
  * db/updateDb.php seed step clears forwarding for extension 504 so
    the test DB stays valid after regenerations; binary db/mikopbx.db
    already reflects this state.

Author: boffart

src/Core/Asterisk/Configs/lua/extensions.lua

@@ -1947,7 +1947,13 @@ extensions.lua_dial_create_chan["_.!"]      = function() if not skip_special_ext
 extensions.dial_answer["_.!"]               = function() if not skip_special_exten() then event_dial_answer() end end
 extensions.lua_transfer_dial_create_chan["_.!"] = function() if not skip_special_exten() then event_transfer_dial_create_chan() end end
 extensions.transfer_dial_answer["_.!"]      = function() if not skip_special_exten() then event_transfer_dial_answer() end end
-extensions.transfer_dial_hangup["_.!"]      = function() if not skip_special_exten() then event_transfer_dial_hangup() end end
+-- transfer_dial_hangup runs from two paths:
+--   1) `exten => h,1,Goto(transfer_dial_hangup,h,1)` (hangup handler, EXTEN='h')
+--   2) `Gosub(transfer_dial_hangup,${EXTEN},1)` (post-Dial, EXTEN=dialed number)
+-- event_transfer_dial_hangup() branches on EXTEN internally and is safe in both cases —
+-- never gate it with skip_special_exten(): that suppressed the 'h' path entirely and
+-- broke MixMonitor resume after failed attended transfers.
+extensions.transfer_dial_hangup["_.!"]      = function() event_transfer_dial_hangup() end
 extensions.hangup_chan["_.!"]               = function() event_hangup_chan() end
 extensions.queue_start["_.!"]               = function() if not skip_special_exten() then event_queue_start() end end
 extensions.queue_answer["_.!"]              = function() if not skip_special_exten() then event_queue_answer() end end

src/Core/Workers/Libs/WorkerCallEvents/ActionTransferDialHangup.php

@@ -126,12 +126,14 @@ private static function fillLocalChannelCdr(WorkerCallEvents $worker, array $dat
      */
     private static function fillNotAnsweredCdr(WorkerCallEvents $worker, array $data): void
     {
+        // Close the transfer-attempt CDR. When the transfer target never picked up
+        // (e.g. CHANUNAVAIL / NO_CONTACTS), the row has transfer=1 and an empty dst_chan —
+        // matching on src_chan=TRANSFERERNAME is enough to identify it.
         $filter = [
-            'linkedid=:linkedid: AND endtime = "" AND (src_chan=:src_chan: AND dst_chan=:dst_chan:)',
+            'linkedid=:linkedid: AND endtime = "" AND transfer = "1" AND src_chan = :src_chan:',
             'bind' => [
                 'linkedid' => $data['linkedid'],
                 'src_chan' => $data['TRANSFERERNAME'],
-                'dst_chan' => empty($data['dst_chan'])?$data['agi_channel']:$data['dst_chan'],
             ],
         ];
         /** @var CallDetailRecordsTmp $m_data */
@@ -152,7 +154,8 @@ private static function fillNotAnsweredCdr(WorkerCallEvents $worker, array $data
             ],
         ];
         $m_data = CallDetailRecordsTmp::find($filter);
-        if ($m_data->count() !== '1') {
+        // Phalcon Resultset::count() returns int — compare as int, not against string '1'.
+        if ($m_data->count() !== 1) {
             // The transfer is not completed or channels no longer exist.
             return;
         }

src/Core/Workers/Libs/WorkerPrepareAdvice/CheckSSHConfig.php

@@ -42,11 +42,25 @@ class CheckSSHConfig extends Injectable
      * The SSH password is now stored as SHA-512 hash in SSH_PASSWORD,
      * so we only check if /etc/shadow was modified outside of MikoPBX.
      *
+     * When password-based SSH logins are disabled (SSHDisablePasswordLogins=true),
+     * /etc/shadow is not security-relevant for SSH access — dropbear accepts
+     * public-key auth only. PAM bookkeeping (lastchg, locking, system maintenance)
+     * still mutates /etc/shadow and would otherwise raise spurious alerts.
+     *
      * @return array<string, array<int, array<string, mixed>>> An array containing warning messages.
      */
     public function process(): array
     {
         $messages = [];
+
+        $passwordLoginsDisabled = PbxSettings::getValueByKey(
+            PbxSettings::SSH_DISABLE_SSH_PASSWORD,
+            false
+        );
+        if (filter_var($passwordLoginsDisabled, FILTER_VALIDATE_BOOLEAN)) {
+            return $messages;
+        }
+
         $hashFile = PbxSettings::getValueByKey(PbxSettings::SSH_PASSWORD_HASH_FILE, false);
 
         // Check if /etc/shadow was modified outside of MikoPBX

tests/Calls/Scripts/09-call-A-to-B-attended-B-to-offNum/start.php

@@ -20,9 +20,11 @@
 require_once __DIR__.'/../TestCallsBase.php';
 
 $sampleCDR = [];
+// Main A↔B conversation continues after the failed attended-transfer attempt;
+// the call recording resumes within the same CDR (single recording file).
 $sampleCDR[] = ['src_num'=>'aNum', 'dst_num'=>'bNum',  'duration'=>'14', 'billsec'=>'12', 'fileDuration' => '7'];
-$sampleCDR[] = ['src_num'=>'bNum', 'dst_num'=>'offNum','duration'=>'1',  'billsec'=>'0',  'fileDuration' => '0'];
-$sampleCDR[] = ['src_num'=>'bNum', 'duration'=>'3',  'billsec'=>'2',  'fileDuration' => '2'];
-$sampleCDR[] = ['src_num'=>'aNum', 'duration'=>'5',  'billsec'=>'5',  'fileDuration' => '5'];
+// Attended-transfer attempt to an unreachable offNum — separate CDR, NO_ANSWER, no recording.
+// Asterisk retries the unreachable PJSIP endpoint for ~6s before giving up.
+$sampleCDR[] = ['src_num'=>'bNum', 'dst_num'=>'offNum','duration'=>'6',  'billsec'=>'0',  'fileDuration' => '0'];
 
 TestCallsBase::executeTest($sampleCDR);

tests/Calls/Scripts/TestCallsBase.php

@@ -20,6 +20,7 @@
 namespace MikoPBX\Tests\Calls\Scripts;
 use MikoPBX\Common\Models\CallDetailRecords;
 use MikoPBX\Common\Models\CallDetailRecordsTmp;
+use MikoPBX\Common\Models\ExtensionForwardingRights;
 use MikoPBX\Common\Providers\CDRDatabaseProvider;
 use MikoPBX\Core\Asterisk\AsteriskManager;
 use MikoPBX\Core\System\Directories;
@@ -89,16 +90,33 @@ public static function getIdlePeers():array{
         return $db_data;
     }
 
-    /** Возвращает недоступные пиры */
+    /**
+     * Returns unreachable peers (PJSIP state != OK).
+     * Skips peers that have any forwarding configured (forwarding / forwardingonbusy /
+     * forwardingonunavailable). Otherwise test 09 receives an ANSWERED CDR to the
+     * redirect target instead of the expected NO_ANSWER on the offline endpoint.
+     */
     public static function getOffPeers():array{
         $am = Util::getAstManager('off');
         $result = $am->getPjSipPeers();
+        $forwardedExtensions = [];
+        $fwdRows = ExtensionForwardingRights::find();
+        foreach ($fwdRows as $row){
+            if (!empty($row->forwarding) || !empty($row->forwardingonbusy) || !empty($row->forwardingonunavailable)){
+                $forwardedExtensions[$row->extension] = true;
+            }
+        }
         $db_data = array();
         foreach ($result as $peer){
-            if($peer['state']!== 'OK' && is_numeric($peer['id'])){
-                $db_data[] = $peer['id'];
+            if($peer['state'] === 'OK' || !is_numeric($peer['id'])){
+                continue;
+            }
+            if(isset($forwardedExtensions[$peer['id']])){
+                continue;
             }
+            $db_data[] = $peer['id'];
         }
+        sort($db_data, SORT_NUMERIC);
         return $db_data;
     }
 

tests/Calls/db/mikopbx.db

@@ -1,6 +1,7 @@
 #!/usr/bin/php
 <?php
 require_once 'Globals.php';
+use MikoPBX\Common\Models\ExtensionForwardingRights;
 use MikoPBX\Core\Asterisk\Configs\AsteriskConf;
 use MikoPBX\Core\Asterisk\Configs\ExtensionsConf;
 use MikoPBX\Core\Asterisk\Configs\FeaturesConf;
@@ -14,6 +15,18 @@
 
 $dbUpdater = new UpdateDatabase();
 $dbUpdater->updateDatabaseStructure();
+
+// Test 09 (call-A-to-B-attended-B-to-offNum) needs at least one offline SIP peer
+// with NO forwarding configured: otherwise the attended-transfer attempt is redirected
+// to the mobile number and the test gets ANSWERED CDR via trunk instead of NO_ANSWER.
+// Keep extension 504 forwarding-free regardless of how the test DB was generated.
+foreach (ExtensionForwardingRights::find(['extension = :ext:', 'bind' => ['ext' => '504']]) as $row) {
+    $row->writeAttribute('forwarding', '');
+    $row->writeAttribute('forwardingonbusy', '');
+    $row->writeAttribute('forwardingonunavailable', '');
+    $row->save();
+}
+
 SIPConf::reload();;
 ExtensionsConf::reload();
 ManagerConf::reload();

tests/Calls/db/updateDb.php

@@ -38,15 +38,49 @@ function cleanup() {
 
     # Восстанавливаем production базу данных
     if [ "$didSwapDb" = "true" ] && [ -f "$dumpConfFile" ]; then
+        echo_info "Stopping services holding the DB...";
+        # Stop only the services that hold mikopbx.db open. NEVER call `monit stop all`:
+        # it brings down dropbear/sshd and locks the host out of remote access.
+        monit stop asterisk > /dev/null 2>&1 || true;
+        monit stop php-fpm  > /dev/null 2>&1 || true;
+
+        # Wait up to ~30s for processes to release the DB.
+        local i;
+        for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+            if [ -z "$(lsof "$confFile" 2>/dev/null | awk 'NR>1')" ]; then
+                break;
+            fi
+            sleep 2;
+        done
+
+        # Force-kill any stragglers (PHP workers outside monit). Never touches the SSH session.
+        local stragglers;
+        stragglers=$(lsof "$confFile" 2>/dev/null | awk 'NR>1 {print $2}' | sort -u);
+        if [ -n "$stragglers" ]; then
+            echo "$stragglers" | xargs -r kill -TERM 2>/dev/null || true;
+            sleep 2;
+            stragglers=$(lsof "$confFile" 2>/dev/null | awk 'NR>1 {print $2}' | sort -u);
+            [ -n "$stragglers" ] && echo "$stragglers" | xargs -r kill -KILL 2>/dev/null || true;
+        fi
+
         echo_info "Restoring production database...";
+        # Remove stale WAL/SHM from the test DB BEFORE cp.
+        # Otherwise SQLite will replay the old WAL on top of the restored file and the DB
+        # ends up "malformed" — exactly the corruption we observed before this fix.
+        rm -f "${confFile}-wal" "${confFile}-shm";
         cp "$dumpConfFile" "$confFile";
+        sync;
 
         if [ "${debugParams}x" != "x" ]; then
             export XDEBUG_CONFIG="${EMPTY}";
         fi;
         php -f "$dirName/db/updateDb.php" > /dev/null 2>/dev/null;
         iptables -F 2>/dev/null; iptables -X 2>/dev/null;
         export XDEBUG_CONFIG="${debugParams}";
+
+        # Bring services back via monit, named (not `start all`) — see comment above.
+        monit start php-fpm  > /dev/null 2>&1 || true;
+        monit start asterisk > /dev/null 2>&1 || true;
     fi
 }
 trap cleanup EXIT INT TERM