Separate display identity and outbound authorization
Keep extensions 7101 and 7102, IVR 7180 and queue 7190. Internal calls should present the extension number. The authorized test trunk should use an approved caller ID. Access to that route depends on the authenticated account and an administrator-controlled directory flag. The examples were checked against FreeSWITCH v1.10.12 templates and current documentation. No live trunk test was performed.
Merge the directory variables
Add or update these variables inside the existing 7101 user entry. Preserve credentials and context. For 7102, use its own name and number and set the permission to no for the negative test.
<variables>
<!-- 合并到现有7101用户的variables，不替换用户文件 -->
<variable name="effective_caller_id_name" value="Training 7101"/>
<!-- 内部互拨显示分机号 -->
<variable name="effective_caller_id_number" value="7101"/>
<!-- 管理员授予此用户实验外呼权限 -->
<variable name="training_outbound_allowed" value="yes"/>
</variables>
The effective caller ID fields affect presentation on a subsequent bridge. Handset contacts can affect the displayed name. Directory outbound_caller_id fields only affect this workflow if existing routing consumes them. The custom flag is a string without units. The dialplan condition gives it meaning. Built-in toll_allow values likewise need a route that checks them. An accounting code alone grants no access. Queue agents and tiers are separate from SIP users and remain as configured.
Replace the episode 07 route
Back up and move the old fragment out of the included directory. Save the new file as 08_training_outbound.xml in the same internal default context. Remove competing test rules so an older rule cannot bypass the new condition.
<include>
<!-- 沿用06期鉴权范围，只在内部default上下文加载 -->
<extension name="training-outbound-08">
<condition field="${sip_auth_username}" expression="^(?:7101|7102)$"/>
<!-- 由管理员在目录中发放，仅接受明确的允许值 -->
<condition field="${training_outbound_allowed}" expression="^yes$"/>
<!-- 替换为唯一获准的测试号码，暂时保留占位符即可做静态检查 -->
<condition field="destination_number" expression="^9(YOUR_TEST_NUMBER)$">
<!-- 只取括号捕获的号码，去掉接入码9 -->
<action application="set" data="training_number=$1"/>
<!-- 示例中继需要86前缀，仅在运营商确认后启用 -->
<action application="set" data="training_carrier_number=86${training_number}"/>
<!-- 只在这条外呼规则内覆盖送给对端的主叫 -->
<action application="set" data="effective_caller_id_name=Training Desk"/>
<action application="set" data="effective_caller_id_number=YOUR_APPROVED_CLI"/>
<!-- 沿用06期gateway，只在授权测试环境拨打 -->
<action application="bridge" data="sofia/gateway/training_carrier_reg/${training_carrier_number}"/>
<action application="hangup"/>
</condition>
</extension>
</include>
Replace YOUR_TEST_NUMBER with the one authorized test destination and YOUR_APPROVED_CLI with a carrier-authorized presentation number. Keep the tested gateway name and destination rewriting from episode 07. The 86 prefix is conditional on the trunk's required destination format.
The first two conditions check INVITE authentication and the directory flag. Treat that flag as trusted only when supplied by controlled configuration. Check for variables imported from external inputs. A failed condition skips this extension. Inspect the rest of the context for broader routes that could still place the call.
Compare the outbound INVITE with the called phone
Check the Request-URI user for the destination and inspect From and the carrier-agreed identity header for caller presentation. A gateway can present a fixed From identity. RFC 3325 describes asserted identity within a trust domain. Incoming identity headers from untrusted endpoints cannot establish authorization.
If the carrier reads From, inspect from-user and caller-id-in-from. Changing a gateway can affect other calls, so test separately. For an agreed P-Asserted-Identity setup, inspect sip_cid_type and the actual packet. Carrier policies, privacy and handset behavior can still change the displayed result. An application that originates a new leg may use origination_caller_id_number in its dial string. That differs from setting effective_caller_id_number on an existing channel before bridge.
Verify and roll back
Run reloadxml and inspect parsing errors. Use new calls and verify that directory caching or external directory backends supply the updated variables. Check three points in a test environment. Verify internal display and the IVR and queue routes. Call the approved destination as 7101 and compare caller and destination identity on the outbound leg with what the called phone displays. Try the same destination as 7102 and verify neither this route nor a competing route sends it to the carrier. Redact captured signaling. Real calls may incur charges.
For stale internal display, check directory loading, later overrides and handset contacts. If the trunk account appears, inspect From and the agreed identity header. If signaling is correct but presentation differs, ask the carrier to trace the redacted call. If 7102 still reaches the trunk, inspect the matching extension and the permission flag source.
Restore the original directory variables and episode 07 fragment, remove episode 08 from the included directory and run reloadxml. Recheck internal calling and the original authorized route. An XML-only directory and dialplan change does not require restarting the trunk profile.